feat: professional README, .env.example, architecture diagram

fix: ensure password auth is set in all startup paths

feat: switch to password auth + project README

fix: add dangerouslyDisableDeviceAuth for remote WS connections

fix: use fixed auth token + python-based token injection + restore entrypoint inject

fix: disable auth (mode:none) + patch CSP frame-ancestors for HF iframe embedding

fix: use auth:{} instead of auth:false (object required)

fix: disable gateway auth (HF provides access control), remove token inject hack

fix: remove empty apiKey (config invalid), add HF origins to CSP allowedOrigins

perf: node user build (-104s chown), merge RUN layers (-170s), plugin whitelist (-40s)

feat: add timing to all stages, fix OPENROUTER_API_KEY crash, async DNS

deploy: HuggingClaw with original Dockerfile