fix: address PR #149 review findings

- Replace custom contains/searchString with strings.Contains in tests
- Fix variable shadow (r -> reposJSON) in workspace handler
- Wire daemon auth token + server URL into spawned agent env vars
- Remove unused CreateAgentTaskWithContext query (dead code after refactor)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/internal/daemon/daemon.go

@@ -584,9 +584,15 @@ func (d *Daemon) runTask(ctx context.Context, task Task, provider string) (TaskR
 
 	prompt := BuildPrompt(task)
 
+	// Pass the daemon's auth credentials so the spawned agent CLI can call
+	// the Multica API (e.g. `multica issue get`, `multica issue comment add`).
 	backend, err := agent.New(provider, agent.Config{
 		ExecutablePath: entry.Path,
-		Logger:         d.logger,
+		Env: map[string]string{
+			"MULTICA_TOKEN":      d.client.Token(),
+			"MULTICA_SERVER_URL": d.cfg.ServerBaseURL,
+		},
+		Logger: d.logger,
 	})
 	if err != nil {
 		return TaskResult{}, fmt.Errorf("create agent backend: %w", err)