## Summary - add `bun run dev:exe` with VM discovery through the documented exe.dev Reflection integration - derive the exact OAuth origin per VM and configure private WSS HMR with an exact Vite host allowlist - lock OAuth redirects to configured origin despite reverse-proxy headers - fix the root migration command and document the wildcard development callback setup

## Testing - `bun test` (657 passed, 2 skipped) - `bun run types` - `bun run ci` - `bun run build` - live smoke tests for local and exe.dev supervisors, OAuth redirect URI, and Vite host rejection