Function ensure_api_env_at 

fn ensure_api_env_at(etc_root: &Path) -> Result<Option<String>>

Create or reuse horto-os-ui/api.env under etc_root and return the bearer hex.

Production passes etc_root = /etc. Tests pass a temp directory so CI never writes the real host /etc.

Behavior:

• Missing file → generate a random hex token, write HORTO_API_TOKEN=… mode 0600
• Existing file → keep it (reinstall must not rotate the bearer)
• File present but value not valid hex → Ok(None)

Errors

Returns crate::HortoError when the directory or file cannot be created/read.