fix: resolve 6 issues (#32 #31 #25 #33 #29 #23)

- #32: parseCookies decodeURIComponent crash with malformed cookies (Authelia)
- #31: Gateway restart no longer overwrites user CORS allowedOrigins (merge instead)
- #25: Windows terminal flashing - add CREATE_NO_WINDOW to skills.rs + assistant.rs
- #33: Model test tolerates non-auth HTTP errors (Ali Coding Plan compatibility)
- #29: Auto-detect ws/wss protocol for reverse proxy + protocol-aware Docker URLs
- #23: Chat session sidebar stays open when switching sessions

scripts/dev-api.js

@@ -153,7 +153,7 @@ function parseCookies(req) {
   const obj = {}
   ;(req.headers.cookie || '').split(';').forEach(pair => {
     const [k, ...v] = pair.trim().split('=')
-    if (k) obj[k] = decodeURIComponent(v.join('='))
+    if (k) try { obj[k] = decodeURIComponent(v.join('=')) } catch (_) { obj[k] = v.join('=') }
   })
   return obj
 }