Add hub AI config tab with sync to instances and deploy secret bootstrap.

Wire bootstrap_deploy_secrets into setup_env.sh (one-time HUB_BRIDGE_TOKEN, FLASK_SECRET_KEY, HUB_SESSION_SECRET). Remove AI section from instance env UI; hub saves OPENAI settings to all four .env files. SSO unchanged.

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/instance/templates/env_config_panel.html

@@ -4,7 +4,7 @@
         <div class="env-config-head-row">
             <div>
                 <h2>env 配置</h2>
-                <p class="settings-env-hint env-config-head-hint">按分类修改，改完点保存。含「需重启」的项请用「保存并重启」。</p>
+                <p class="settings-env-hint env-config-head-hint">按分类修改，改完点保存。含「需重启」的项请用「保存并重启」。<strong>AI 配置</strong>请在中控 → 系统设置 → AI 配置统一维护。</p>
             </div>
             <div class="env-config-toolbar">
                 <button type="button" class="btn-primary btn-sm" id="env-config-save">保存</button>