LAN access key: 128-bit token (was 48-bit for typability)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016jXZFSTZQKzAC8fqpWSz9g

src/bggpipe/webreview.py

@@ -1080,7 +1080,10 @@ def run_web_review(
     import uvicorn
 
     url = f"http://127.0.0.1:{port}{landing}"
-    token = secrets.token_urlsafe(6) if lan else None
+    # 16 bytes = 128-bit key: standard session-credential strength. The
+    # cost is a longer one-time URL to get onto the phone — copy it, or
+    # type it once; the cookie remembers it from then on.
+    token = secrets.token_urlsafe(16) if lan else None
     if lan:
         ips = sorted(h for h in lan_hosts() if h.replace(".", "").isdigit())
         names = sorted(h for h in lan_hosts() if not h.replace(".", "").isdigit())