fix: post-review fixes for PRs #1311/#1312/#1313 + CHANGELOG

- sdkconfig.defaults.devkitc: header build command idf v5.2 -> v5.4
  (source needs esp_driver_uart, IDF >=5.3 — same reason the PR fixed
  the README refs)
- engine/lib.rs: separate doc comments — set_room_adapter's ADR-150
  adapter/witness doc had merged into set_multistatic_config's doc
- ui: apply stored bearer token at api.service.js module load instead
  of QuickSettings.init — services + dashboard tab dispatch their first
  /api/v1/* requests before initializeEnhancements() runs, so the first
  requests on every load went out without the Authorization header
- CHANGELOG: Unreleased entries for #1308/#1309/#1310

Co-Authored-By: claude-flow <ruv@ruv.net>

ui/services/api.service.js

@@ -147,4 +147,17 @@ export class ApiService {
 }
 
 // Create singleton instance
-export const apiService = new ApiService();
+export const apiService = new ApiService();
+
+// Storage key shared with the QuickSettings "API Access" panel.
+export const API_TOKEN_STORAGE_KEY = 'ruview-api-token';
+
+// Apply a previously-saved bearer token at module load — before app init
+// dispatches its first request — so a configured RUVIEW_API_TOKEN works from
+// the very first /api/v1/* call. The server only ever checks the
+// `Authorization: Bearer` header (see bearer_auth.rs) — this intentionally
+// never puts the token in a URL query string.
+try {
+  const storedToken = localStorage.getItem(API_TOKEN_STORAGE_KEY);
+  if (storedToken) apiService.setAuthToken(storedToken);
+} catch { /* storage unavailable (private browsing etc.) */ }