Drop the hook-template scheme and other dead weight

hooks/hooks.json was generated from a template by scripts/gen-hooks.mjs. Once every
hook became a command hook that reads hook.secret from $GLANCE_HOME itself, the
template had exactly two placeholders left: {{HOOK_TOKEN}}, which nothing had ever
substituted into anything, and {{APPROVAL_TIMEOUT_SECS}}. Generating a whole file to
compute one number is not a good trade, so the number is now fixed at 125s in the
committed hooks.json and the coupling is enforced in code instead: the daemon clamps
approval.timeoutMs to APPROVAL_MAX_WAIT_MS (90s), which keeps the script inside its
own hook timeout no matter what a hand-edited config.json says. Losing that clamp is
what would actually hurt — a killed script never runs its fail-open path.

Also removed:

- `glance sync-hooks`, `npm run build:hooks`, and hookSecret({create}). The daemon is
  the only thing that should ever mint the secret.
- The ?k= query-string carrier for the hook secret. It existed for hooks that cannot
  set headers; there are none, and a secret in a URL lands in logs and shell history.
- Snapshot.now and SessionView.startedAt, which were written on every snapshot and
  every persist and read by nobody.
- An unused crypto import.

Docs and the e2e suite follow. The suite's ~12 sync-hooks assertions become static
checks on the committed file, plus new ones that hooks.json, APPROVAL_HOOK_TIMEOUT_SECS
and APPROVAL_MAX_WAIT_MS still agree, and that ?k= is refused. 220 checks, all passing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

bin/glance

@@ -10,7 +10,7 @@
 
 import fs from "node:fs";
 import path from "node:path";
-import { spawn, spawnSync } from "node:child_process";
+import { spawn } from "node:child_process";
 import {
   PLUGIN_ROOT,
   baseUrl,
@@ -221,23 +221,6 @@ switch (cmd) {
     break;
   }
 
-  case "sync-hooks": {
-    // hooks.json is generated, not edited: regenerate it from hooks/hooks.template.json.
-    // The port is not baked into it any more — the hook scripts read config.json themselves —
-    // so the thing this actually refreshes is the approval gate's timeout, plus the hook
-    // secret if it has gone missing.
-    const { status } = spawnSync(
-      process.execPath,
-      [path.join(PLUGIN_ROOT, "scripts", "gen-hooks.mjs")],
-      { stdio: "inherit" },
-    );
-    if (status !== 0) process.exit(status ?? 1);
-    if (await isDaemonUp(cfg)) {
-      console.log("restart the daemon to pick up config changes: glance stop && glance up");
-    }
-    break;
-  }
-
   case "logs": {
     const file = path.join(glanceHome(), "daemon.log");
     if (!fs.existsSync(file)) {
@@ -260,7 +243,6 @@ switch (cmd) {
   glance devices                list enrolled devices
   glance revoke <id-prefix>     revoke a device
   glance approval <off|risky|all>   remote approval policy
-  glance sync-hooks             regenerate hooks/hooks.json from the template
   glance logs                   tail the daemon log
 `);
 }