fix: post-review fixes for PRs #1311/#1312/#1313 + CHANGELOG

- sdkconfig.defaults.devkitc: header build command idf v5.2 -> v5.4
  (source needs esp_driver_uart, IDF >=5.3 — same reason the PR fixed
  the README refs)
- engine/lib.rs: separate doc comments — set_room_adapter's ADR-150
  adapter/witness doc had merged into set_multistatic_config's doc
- ui: apply stored bearer token at api.service.js module load instead
  of QuickSettings.init — services + dashboard tab dispatch their first
  /api/v1/* requests before initializeEnhancements() runs, so the first
  requests on every load went out without the Authorization header
- CHANGELOG: Unreleased entries for #1308/#1309/#1310

Co-Authored-By: claude-flow <ruv@ruv.net>

ui/utils/quick-settings.js

@@ -1,9 +1,7 @@
 // Quick Settings Panel - Centralized configuration for all UI features
 // Accessible via gear icon in header
 
-import { apiService } from '../services/api.service.js';
-
-const API_TOKEN_STORAGE_KEY = 'ruview-api-token';
+import { apiService, API_TOKEN_STORAGE_KEY } from '../services/api.service.js';
 
 export class QuickSettings {
   constructor(app) {
@@ -13,22 +11,13 @@ export class QuickSettings {
     this.isOpen = false;
   }
 
+  // A stored token is applied at api.service.js module load (before any
+  // request fires) — this panel only saves/clears it.
   init() {
-    this.applyStoredApiToken();
     this.createButton();
     this.createPanel();
   }
 
-  // Apply a previously-saved bearer token to apiService as early as
-  // possible, before any tab's REST calls fire. The server only ever
-  // checks the `Authorization: Bearer` header (see bearer_auth.rs) — this
-  // intentionally never puts the token in a URL query string.
-  applyStoredApiToken() {
-    let token = null;
-    try { token = localStorage.getItem(API_TOKEN_STORAGE_KEY); } catch { /* noop */ }
-    if (token) apiService.setAuthToken(token);
-  }
-
   createButton() {
     this.button = document.createElement('button');
     this.button.className = 'settings-gear';