fix: clear bootstrap token after first IPC read to prevent stale token reuse

The backendBootstrapToken has remainingUses: 1 on the server side, so it is
deleted after the first successful consume. Clear the module-level variable
after the first IPC read so subsequent calls do not return a stale,
already-consumed token that would silently fail to authenticate.

Author: cursoragent

apps/desktop/src/main.ts

@@ -1239,10 +1239,14 @@ function registerIpcHandlers(): void {
 
   ipcMain.removeAllListeners(GET_LOCAL_ENVIRONMENT_BOOTSTRAP_CHANNEL);
   ipcMain.on(GET_LOCAL_ENVIRONMENT_BOOTSTRAP_CHANNEL, (event) => {
+    const token = backendBootstrapToken || undefined;
+    if (token) {
+      backendBootstrapToken = "";
+    }
     event.returnValue = {
       label: "Local environment",
       wsUrl: backendWsUrl || null,
-      bootstrapToken: backendBootstrapToken || undefined,
+      bootstrapToken: token,
     } as const;
   });