Add hub AI config tab with sync to instances and deploy secret bootstrap.

Wire bootstrap_deploy_secrets into setup_env.sh (one-time HUB_BRIDGE_TOKEN, FLASK_SECRET_KEY, HUB_SESSION_SECRET). Remove AI section from instance env UI; hub saves OPENAI settings to all four .env files. SSO unchanged.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/setup_env.sh

@@ -249,8 +249,15 @@ should_include hub && setup_hub
 
 install_pm2
 
+step "部署密钥（首次自动生成，不覆盖已有）"
+if command -v python3 >/dev/null 2>&1; then
+  python3 "${REPO_ROOT}/scripts/bootstrap_deploy_secrets.py" || true
+else
+  echo "  跳过 bootstrap_deploy_secrets（未找到 python3）"
+fi
+
 echo ""
 echo "部署完成。下一步："
-echo "  1. 编辑各子目录 .env"
+echo "  1. 编辑各子目录 .env（交易所 API 等；AI 请在中控系统设置配置）"
 echo "  2. 编辑各目录 .env 后使用 PM2: pm2 start ecosystem.config.cjs（见 docs/ubuntu-server.md）"
 echo ""