Add hub AI config tab with sync to instances and deploy secret bootstrap.

Wire bootstrap_deploy_secrets into setup_env.sh (one-time HUB_BRIDGE_TOKEN, FLASK_SECRET_KEY, HUB_SESSION_SECRET). Remove AI section from instance env UI; hub saves OPENAI settings to all four .env files. SSO unchanged.

Co-authored-by: Cursor <cursoragent@cursor.com>

manual_trading_hub/agent.py

@@ -10,7 +10,7 @@
   EXCHANGE           binance（默认）| okx | gate
   PORT               默认 15200（与 crypto_monitor_* 的 Flask APP_PORT 错开；中控默认聚合 15200–15202）
   HOST               默认 127.0.0.1
-  CONTROL_TOKEN      可选；请求头 X-Control-Token
+  HUB_BRIDGE_TOKEN   与中控一致；请求头 X-Control-Token（优先于已废弃的 CONTROL_TOKEN）
 
 Binance：BINANCE_API_KEY / BINANCE_API_SECRET；余额为 **U 本位永续合约账户** USDT（与 `crypto_monitor_binance` 的合约口径一致，非现货钱包）；BINANCE_POSITION_MODE；BINANCE_MARGIN_MODE
 OKX：OKX_API_KEY / OKX_API_SECRET / OKX_API_PASSPHRASE；OKX_TD_MODE；OKX_POS_MODE
@@ -54,7 +54,7 @@ from exchange_orders import (
 
 HOST = os.getenv("HOST", "127.0.0.1")
 PORT = int(os.getenv("PORT", "15200"))
-CONTROL_TOKEN = (os.getenv("CONTROL_TOKEN") or "").strip()
+CONTROL_TOKEN = (os.getenv("HUB_BRIDGE_TOKEN") or os.getenv("CONTROL_TOKEN") or "").strip()
 
 _raw_ex = (os.getenv("EXCHANGE") or "binance").strip().lower()
 if _raw_ex in ("binance", "bnb", "ba"):