feat: switch to password auth + project README

fix: add 'unsafe-inline' to CSP script-src for token injection

fix: use global variable for token injection (works in incognito iframe)

fix: disable auth (mode:none) + patch CSP frame-ancestors for HF iframe embedding

deploy: HuggingClaw with original Dockerfile