feat(exec): require configured secret and header auth for /exec

docs/API.md

@@ -147,6 +147,10 @@ Hotkey:
 
 Execute a shell command on the host running Clickthrough.
 
+Requirements:
+- `CLICKTHROUGH_EXEC_SECRET` must be configured on the server
+- send header `x-clickthrough-exec-secret: <secret>`
+
 ```json
 {
   "command": "Get-Process | Select-Object -First 5",
@@ -162,6 +166,7 @@ Notes:
 - if `shell` is omitted, server uses `CLICKTHROUGH_EXEC_DEFAULT_SHELL`
 - output is truncated based on `CLICKTHROUGH_EXEC_MAX_OUTPUT_CHARS`
 - endpoint can be disabled with `CLICKTHROUGH_EXEC_ENABLED=false`
+- if `CLICKTHROUGH_EXEC_SECRET` is missing, `/exec` is blocked (`403`)
 
 Response includes `stdout`, `stderr`, `exit_code`, timeout state, and execution metadata.