feat(tui): add standalone mode and API-based log polling

- Implemented `--standalone` mode to launch an embedded server for TUI.
- Enhanced TUI client to support API-based log polling when log hooks are unavailable.
- Added authentication gate for password input and connection handling.
- Improved localization and UX for logs, authentication, and status bar rendering.

internal/tui/app.go

@@ -1,10 +1,12 @@
 package tui
 
 import (
+	"fmt"
 	"io"
 	"os"
 	"strings"
 
+	"github.com/charmbracelet/bubbles/textinput"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/lipgloss"
 )
@@ -25,6 +27,14 @@ type App struct {
 	activeTab int
 	tabs      []string
 
+	standalone  bool
+	logsEnabled bool
+
+	authenticated  bool
+	authInput      textinput.Model
+	authError      string
+	authConnecting bool
+
 	dashboard dashboardModel
 	config    configTabModel
 	auth      authTabModel
@@ -34,7 +44,7 @@ type App struct {
 	logs      logsTabModel
 
 	client *Client
-	hook   *LogHook
+
 	width  int
 	height int
 	ready  bool
@@ -43,32 +53,60 @@ type App struct {
 	initialized [7]bool
 }
 
+type authConnectMsg struct {
+	cfg map[string]any
+	err error
+}
+
 // NewApp creates the root TUI application model.
 func NewApp(port int, secretKey string, hook *LogHook) App {
+	standalone := hook != nil
+	authRequired := !standalone
+	ti := textinput.New()
+	ti.CharLimit = 512
+	ti.EchoMode = textinput.EchoPassword
+	ti.EchoCharacter = '*'
+	ti.SetValue(strings.TrimSpace(secretKey))
+	ti.Focus()
+
 	client := NewClient(port, secretKey)
-	return App{
-		activeTab: tabDashboard,
-		tabs:      TabNames(),
-		dashboard: newDashboardModel(client),
-		config:    newConfigTabModel(client),
-		auth:      newAuthTabModel(client),
-		keys:      newKeysTabModel(client),
-		oauth:     newOAuthTabModel(client),
-		usage:     newUsageTabModel(client),
-		logs:      newLogsTabModel(hook),
-		client:    client,
-		hook:      hook,
+	app := App{
+		activeTab:     tabDashboard,
+		standalone:    standalone,
+		logsEnabled:   true,
+		authenticated: !authRequired,
+		authInput:     ti,
+		dashboard:     newDashboardModel(client),
+		config:        newConfigTabModel(client),
+		auth:          newAuthTabModel(client),
+		keys:          newKeysTabModel(client),
+		oauth:         newOAuthTabModel(client),
+		usage:         newUsageTabModel(client),
+		logs:          newLogsTabModel(client, hook),
+		client:        client,
+		initialized: [7]bool{
+			tabDashboard: true,
+			tabLogs:      true,
+		},
 	}
+
+	app.refreshTabs()
+	if authRequired {
+		app.initialized = [7]bool{}
+	}
+	app.setAuthInputPrompt()
+	return app
 }
 
 func (a App) Init() tea.Cmd {
-	// Initialize dashboard and logs on start
-	a.initialized[tabDashboard] = true
-	a.initialized[tabLogs] = true
-	return tea.Batch(
-		a.dashboard.Init(),
-		a.logs.Init(),
-	)
+	if !a.authenticated {
+		return textinput.Blink
+	}
+	cmds := []tea.Cmd{a.dashboard.Init()}
+	if a.logsEnabled {
+		cmds = append(cmds, a.logs.Init())
+	}
+	return tea.Batch(cmds...)
 }
 
 func (a App) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
@@ -77,6 +115,9 @@ func (a App) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		a.width = msg.Width
 		a.height = msg.Height
 		a.ready = true
+		if a.width > 0 {
+			a.authInput.Width = a.width - 6
+		}
 		contentH := a.height - 4 // tab bar + status bar
 		if contentH < 1 {
 			contentH = 1
@@ -91,32 +132,119 @@ func (a App) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		a.logs.SetSize(contentW, contentH)
 		return a, nil
 
+	case authConnectMsg:
+		a.authConnecting = false
+		if msg.err != nil {
+			a.authError = fmt.Sprintf(T("auth_gate_connect_fail"), msg.err.Error())
+			return a, nil
+		}
+		a.authError = ""
+		a.authenticated = true
+		a.logsEnabled = a.standalone || isLogsEnabledFromConfig(msg.cfg)
+		a.refreshTabs()
+		a.initialized = [7]bool{}
+		a.initialized[tabDashboard] = true
+		cmds := []tea.Cmd{a.dashboard.Init()}
+		if a.logsEnabled {
+			a.initialized[tabLogs] = true
+			cmds = append(cmds, a.logs.Init())
+		}
+		return a, tea.Batch(cmds...)
+
+	case configUpdateMsg:
+		var cmdLogs tea.Cmd
+		if !a.standalone && msg.err == nil && msg.path == "logging-to-file" {
+			logsEnabledConfig, okConfig := msg.value.(bool)
+			if okConfig {
+				logsEnabledBefore := a.logsEnabled
+				a.logsEnabled = logsEnabledConfig
+				if logsEnabledBefore != a.logsEnabled {
+					a.refreshTabs()
+				}
+				if !a.logsEnabled {
+					a.initialized[tabLogs] = false
+				}
+				if !logsEnabledBefore && a.logsEnabled {
+					a.initialized[tabLogs] = true
+					cmdLogs = a.logs.Init()
+				}
+			}
+		}
+
+		var cmdConfig tea.Cmd
+		a.config, cmdConfig = a.config.Update(msg)
+		if cmdConfig != nil && cmdLogs != nil {
+			return a, tea.Batch(cmdConfig, cmdLogs)
+		}
+		if cmdConfig != nil {
+			return a, cmdConfig
+		}
+		return a, cmdLogs
+
 	case tea.KeyMsg:
+		if !a.authenticated {
+			switch msg.String() {
+			case "ctrl+c", "q":
+				return a, tea.Quit
+			case "L":
+				ToggleLocale()
+				a.refreshTabs()
+				a.setAuthInputPrompt()
+				return a, nil
+			case "enter":
+				if a.authConnecting {
+					return a, nil
+				}
+				password := strings.TrimSpace(a.authInput.Value())
+				if password == "" {
+					a.authError = T("auth_gate_password_required")
+					return a, nil
+				}
+				a.authError = ""
+				a.authConnecting = true
+				return a, a.connectWithPassword(password)
+			default:
+				var cmd tea.Cmd
+				a.authInput, cmd = a.authInput.Update(msg)
+				return a, cmd
+			}
+		}
+
 		switch msg.String() {
 		case "ctrl+c":
 			return a, tea.Quit
 		case "q":
 			// Only quit if not in logs tab (where 'q' might be useful)
-			if a.activeTab != tabLogs {
+			if !a.logsEnabled || a.activeTab != tabLogs {
 				return a, tea.Quit
 			}
 		case "L":
 			ToggleLocale()
-			a.tabs = TabNames()
+			a.refreshTabs()
 			return a.broadcastToAllTabs(localeChangedMsg{})
 		case "tab":
+			if len(a.tabs) == 0 {
+				return a, nil
+			}
 			prevTab := a.activeTab
 			a.activeTab = (a.activeTab + 1) % len(a.tabs)
-			a.tabs = TabNames()
 			return a, a.initTabIfNeeded(prevTab)
 		case "shift+tab":
+			if len(a.tabs) == 0 {
+				return a, nil
+			}
 			prevTab := a.activeTab
 			a.activeTab = (a.activeTab - 1 + len(a.tabs)) % len(a.tabs)
-			a.tabs = TabNames()
 			return a, a.initTabIfNeeded(prevTab)
 		}
 	}
 
+	if !a.authenticated {
+		var cmd tea.Cmd
+		a.authInput, cmd = a.authInput.Update(msg)
+		return a, cmd
+	}
+
 	// Route msg to active tab
 	var cmd tea.Cmd
 	switch a.activeTab {
@@ -136,13 +264,15 @@ func (a App) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		a.logs, cmd = a.logs.Update(msg)
 	}
 
-	// Always route logLineMsg to logs tab even if not active,
-	// AND capture the returned cmd to maintain the waitForLog chain.
-	if _, ok := msg.(logLineMsg); ok && a.activeTab != tabLogs {
-		var logCmd tea.Cmd
-		a.logs, logCmd = a.logs.Update(msg)
-		if logCmd != nil {
-			cmd = logCmd
+	// Keep logs polling alive even when logs tab is not active.
+	if a.logsEnabled && a.activeTab != tabLogs {
+		switch msg.(type) {
+		case logsPollMsg, logsTickMsg, logLineMsg:
+			var logCmd tea.Cmd
+			a.logs, logCmd = a.logs.Update(msg)
+			if logCmd != nil {
+				cmd = logCmd
+			}
 		}
 	}
 
@@ -152,6 +282,30 @@ func (a App) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 // localeChangedMsg is broadcast to all tabs when the user toggles locale.
 type localeChangedMsg struct{}
 
+func (a *App) refreshTabs() {
+	names := TabNames()
+	if a.logsEnabled {
+		a.tabs = names
+	} else {
+		filtered := make([]string, 0, len(names)-1)
+		for idx, name := range names {
+			if idx == tabLogs {
+				continue
+			}
+			filtered = append(filtered, name)
+		}
+		a.tabs = filtered
+	}
+
+	if len(a.tabs) == 0 {
+		a.activeTab = tabDashboard
+		return
+	}
+	if a.activeTab >= len(a.tabs) {
+		a.activeTab = len(a.tabs) - 1
+	}
+}
+
 func (a *App) initTabIfNeeded(_ int) tea.Cmd {
 	if a.initialized[a.activeTab] {
 		return nil
@@ -171,12 +325,19 @@ func (a *App) initTabIfNeeded(_ int) tea.Cmd {
 	case tabUsage:
 		return a.usage.Init()
 	case tabLogs:
+		if !a.logsEnabled {
+			return nil
+		}
 		return a.logs.Init()
 	}
 	return nil
 }
 
 func (a App) View() string {
+	if !a.authenticated {
+		return a.renderAuthView()
+	}
+
 	if !a.ready {
 		return T("initializing_tui")
 	}
@@ -202,7 +363,9 @@ func (a App) View() string {
 	case tabUsage:
 		sb.WriteString(a.usage.View())
 	case tabLogs:
-		sb.WriteString(a.logs.View())
+		if a.logsEnabled {
+			sb.WriteString(a.logs.View())
+		}
 	}
 
 	// Status bar
@@ -212,6 +375,27 @@ func (a App) View() string {
 	return sb.String()
 }
 
+func (a App) renderAuthView() string {
+	var sb strings.Builder
+
+	sb.WriteString(titleStyle.Render(T("auth_gate_title")))
+	sb.WriteString("\n")
+	sb.WriteString(helpStyle.Render(T("auth_gate_help")))
+	sb.WriteString("\n\n")
+	if a.authConnecting {
+		sb.WriteString(warningStyle.Render(T("auth_gate_connecting")))
+		sb.WriteString("\n\n")
+	}
+	if strings.TrimSpace(a.authError) != "" {
+		sb.WriteString(errorStyle.Render(a.authError))
+		sb.WriteString("\n\n")
+	}
+	sb.WriteString(a.authInput.View())
+	sb.WriteString("\n")
+	sb.WriteString(helpStyle.Render(T("auth_gate_enter")))
+	return sb.String()
+}
+
 func (a App) renderTabBar() string {
 	var tabs []string
 	for i, name := range a.tabs {
@@ -226,18 +410,91 @@ func (a App) renderTabBar() string {
 }
 
 func (a App) renderStatusBar() string {
-	left := T("status_left")
-	right := T("status_right")
-	gap := a.width - lipgloss.Width(left) - lipgloss.Width(right)
+	left := strings.TrimRight(T("status_left"), " ")
+	right := strings.TrimRight(T("status_right"), " ")
+
+	width := a.width
+	if width < 1 {
+		width = 1
+	}
+
+	// statusBarStyle has left/right padding(1), so content area is width-2.
+	contentWidth := width - 2
+	if contentWidth < 0 {
+		contentWidth = 0
+	}
+
+	if lipgloss.Width(left) > contentWidth {
+		left = fitStringWidth(left, contentWidth)
+		right = ""
+	}
+
+	remaining := contentWidth - lipgloss.Width(left)
+	if remaining < 0 {
+		remaining = 0
+	}
+	if lipgloss.Width(right) > remaining {
+		right = fitStringWidth(right, remaining)
+	}
+
+	gap := contentWidth - lipgloss.Width(left) - lipgloss.Width(right)
 	if gap < 0 {
 		gap = 0
 	}
-	return statusBarStyle.Width(a.width).Render(left + strings.Repeat(" ", gap) + right)
+	return statusBarStyle.Width(width).Render(left + strings.Repeat(" ", gap) + right)
+}
+
+func fitStringWidth(text string, maxWidth int) string {
+	if maxWidth <= 0 {
+		return ""
+	}
+	if lipgloss.Width(text) <= maxWidth {
+		return text
+	}
+
+	out := ""
+	for _, r := range text {
+		next := out + string(r)
+		if lipgloss.Width(next) > maxWidth {
+			break
+		}
+		out = next
+	}
+	return out
+}
+
+func isLogsEnabledFromConfig(cfg map[string]any) bool {
+	if cfg == nil {
+		return true
+	}
+	value, ok := cfg["logging-to-file"]
+	if !ok {
+		return true
+	}
+	enabled, ok := value.(bool)
+	if !ok {
+		return true
+	}
+	return enabled
+}
+
+func (a *App) setAuthInputPrompt() {
+	if a == nil {
+		return
+	}
+	a.authInput.Prompt = fmt.Sprintf("  %s: ", T("auth_gate_password"))
+}
+
+func (a App) connectWithPassword(password string) tea.Cmd {
+	return func() tea.Msg {
+		a.client.SetSecretKey(password)
+		cfg, errGetConfig := a.client.GetConfig()
+		return authConnectMsg{cfg: cfg, err: errGetConfig}
+	}
 }
 
 // Run starts the TUI application.
 // output specifies where bubbletea renders. If nil, defaults to os.Stdout.
-// Pass the real terminal stdout here when os.Stdout has been redirected.
 func Run(port int, secretKey string, hook *LogHook, output io.Writer) error {
 	if output == nil {
 		output = os.Stdout