fix: persist CLI_API_TOKEN from env var to settings when not already saved

When CLI_API_TOKEN is provided via environment variable, persist it to settings.json
if not already saved. This prevents token regeneration if the env var fails to load
on subsequent startups, ensuring token consistency across server restarts.

server/src/web/cliApiToken.ts

@@ -104,6 +104,14 @@ export async function getOrCreateCliApiToken(dataDir: string): Promise<CliApiTok
         if (isWeakToken(envToken)) {
             console.warn('[WARN] CLI_API_TOKEN appears to be weak. Consider using a stronger secret.')
         }
+
+        // Persist env token to file if not already saved (prevents token loss on env var issues)
+        const settings = await readSettings(settingsFile)
+        if (settings !== null && !settings.cliApiToken) {
+            settings.cliApiToken = envToken
+            await writeSettings(settingsFile, settings)
+        }
+
         return { token: envToken, source: 'env', isNew: false, filePath: settingsFile }
     }