feat: gateway mode switcher + cloud token Keychain separation

- Add cloud_api_token Keychain key separate from local api_token
- Add store/get/delete_cloud_token Tauri commands
- Add GatewayMode (local|cloud) to constants with separate token getters
- Settings: segmented Local/Cloud switcher with mode-specific panels
- Local panel: gateway controls + ProviderKeyManager + auth token
- Cloud panel: login/register/logout + account info
- ProviderKeyManager: Add Custom Provider form (name + baseUrl + apiKey)
- AccountPage: simplified to cloud account management only
- App.tsx: mode-aware init loads correct token from Keychain

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: createpjf

apps/desktop/src-tauri/src/commands.rs

@@ -26,6 +26,21 @@ pub async fn delete_token() -> Result<(), String> {
     keychain::delete_token()
 }
 
+#[tauri::command]
+pub async fn store_cloud_token(token: String) -> Result<(), String> {
+    keychain::store_cloud_token(&token)
+}
+
+#[tauri::command]
+pub async fn get_cloud_token() -> Result<Option<String>, String> {
+    keychain::get_cloud_token()
+}
+
+#[tauri::command]
+pub async fn delete_cloud_token() -> Result<(), String> {
+    keychain::delete_cloud_token()
+}
+
 #[tauri::command]
 pub async fn copy_to_clipboard(text: String) -> Result<(), String> {
     let mut clipboard = Clipboard::new().map_err(|e| e.to_string())?;

apps/desktop/src-tauri/src/keychain.rs

@@ -2,6 +2,7 @@ use keyring::Entry;
 
 const SERVICE_NAME: &str = "com.routebox.app";
 const TOKEN_KEY: &str = "api_token";
+const CLOUD_TOKEN_KEY: &str = "cloud_api_token";
 
 pub fn store_token(token: &str) -> Result<(), String> {
     let entry = Entry::new(SERVICE_NAME, TOKEN_KEY).map_err(|e| e.to_string())?;
@@ -25,3 +26,26 @@ pub fn delete_token() -> Result<(), String> {
         Err(e) => Err(e.to_string()),
     }
 }
+
+pub fn store_cloud_token(token: &str) -> Result<(), String> {
+    let entry = Entry::new(SERVICE_NAME, CLOUD_TOKEN_KEY).map_err(|e| e.to_string())?;
+    entry.set_password(token).map_err(|e| e.to_string())
+}
+
+pub fn get_cloud_token() -> Result<Option<String>, String> {
+    let entry = Entry::new(SERVICE_NAME, CLOUD_TOKEN_KEY).map_err(|e| e.to_string())?;
+    match entry.get_password() {
+        Ok(token) => Ok(Some(token)),
+        Err(keyring::Error::NoEntry) => Ok(None),
+        Err(e) => Err(e.to_string()),
+    }
+}
+
+pub fn delete_cloud_token() -> Result<(), String> {
+    let entry = Entry::new(SERVICE_NAME, CLOUD_TOKEN_KEY).map_err(|e| e.to_string())?;
+    match entry.delete_credential() {
+        Ok(()) => Ok(()),
+        Err(keyring::Error::NoEntry) => Ok(()),
+        Err(e) => Err(e.to_string()),
+    }
+}

apps/desktop/src-tauri/src/lib.rs

@@ -111,6 +111,9 @@ pub fn run() {
             commands::store_token,
             commands::get_token,
             commands::delete_token,
+            commands::store_cloud_token,
+            commands::get_cloud_token,
+            commands::delete_cloud_token,
             commands::copy_to_clipboard,
             commands::show_notification,
             commands::toggle_panel,

apps/desktop/src/App.tsx

@@ -16,7 +16,7 @@ import { AlertBanner } from "@/components/AlertBanner";
 import { ToastContainer } from "@/components/ToastContainer";
 import { useRealtimeStats } from "@/hooks/useRealtimeStats";
 import { useToast } from "@/hooks/useToast";
-import { getGatewayUrl, setGatewayUrl, setAuthToken, getPortFromUrl } from "@/lib/constants";
+import { getGatewayUrl, setGatewayUrl, setAuthToken, setCloudAuthToken, setGatewayMode, getGatewayMode, getPortFromUrl, ROUTEBOX_CLOUD_URL } from "@/lib/constants";
 import { checkGatewayHealth, waitForGateway, isLocalGatewayUrl } from "@/lib/gateway-health";
 import type { RealtimeStats, RequestLogEntry } from "@/types/stats";
 
@@ -45,27 +45,48 @@ export function App() {
 
   // Load persisted settings before any API calls
   useEffect(() => {
-    import("@tauri-apps/plugin-store")
-      .then(({ load }) => load("settings.json", { defaults: {} }))
-      .then(async (store) => {
+    async function loadSettings() {
+      try {
+        const { load } = await import("@tauri-apps/plugin-store");
+        const store = await load("settings.json", { defaults: {} });
+
+        const mode = await store.get<string>("gatewayMode");
+        const savedMode = mode === "cloud" ? "cloud" : "local";
+        setGatewayMode(savedMode);
+
         const url = await store.get<string>("gatewayUrl");
-        if (url) setGatewayUrl(url);
+        if (url) {
+          setGatewayUrl(url);
+        } else {
+          // Apply default URL based on mode
+          setGatewayUrl(savedMode === "cloud" ? ROUTEBOX_CLOUD_URL : "http://localhost:3001");
+        }
 
         const dismissed = await store.get<boolean>("onboardingDismissed");
         setOnboardingDismissed(!!dismissed);
-      })
-      .catch(() => {
-        // Not in Tauri — check if we should show onboarding anyway
+
+        // Load the appropriate token based on mode
+        const { invoke } = await import("@tauri-apps/api/core");
+        if (savedMode === "cloud") {
+          try {
+            const t = await invoke<string>("get_cloud_token");
+            if (t) { setCloudAuthToken(t); setToken(t); }
+          } catch {}
+        } else {
+          try {
+            const t = await invoke<string>("get_token");
+            if (t) { setAuthToken(t); setToken(t); }
+          } catch {}
+        }
+      } catch {
+        // Not in Tauri
         setOnboardingDismissed(false);
-      })
-      .finally(() => {
+      } finally {
         setSettingsLoaded(true);
-      });
+      }
+    }
 
-    import("@tauri-apps/api/core")
-      .then(({ invoke }) => invoke<string>("get_token"))
-      .then((t) => { if (t) { setAuthToken(t); setToken(t); } })
-      .catch(() => {});
+    loadSettings();
   }, []);
 
   // Gateway auto-start — waits for settings to be loaded first
@@ -89,7 +110,8 @@ export function App() {
         }
 
         const url = getGatewayUrl();
-        const isLocal = isLocalGatewayUrl(url);
+        const currentMode = getGatewayMode();
+        const isLocal = currentMode === "local" && isLocalGatewayUrl(url);
         setGatewayState("checking");
 
         // Already running / reachable?