fix: require password login by default on first install.

Set APP_AUTH_DISABLED=false in exchange env examples so LAN deploys no longer skip auth.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/bootstrap_deploy_secrets.py

@@ -5,6 +5,7 @@
 - FLASK_SECRET_KEY:三实例(相同)
 - HUB_SESSION_SECRET:仅中控
 - APP_USERNAME=admin,APP_PASSWORD=admin123:实例(仅空时)
+- APP_AUTH_DISABLED=false:键缺失/为空时写入(首次安装默认必须登录)
 - HUB_USERNAME=admin,HUB_PASSWORD=admin123:中控(仅空时)
 
 已有非空且非占位符的值不会被覆盖(长期密钥一次生成,不轮换).
@@ -84,6 +85,9 @@ def main() -> int:
             updates["APP_USERNAME"] = "admin"
         if _should_set(env_get(lines, "APP_PASSWORD"), frozenset({""})):
             updates["APP_PASSWORD"] = "admin123"
+        # 键缺失时默认开启登录;已有 true/false 不覆盖(模板已改为 false)
+        if not (env_get(lines, "APP_AUTH_DISABLED") or "").strip():
+            updates["APP_AUTH_DISABLED"] = "false"
         if updates:
             planned.append((path, updates))