feat: professional README, .env.example, architecture diagram

fix: ensure password auth is set in all startup paths

feat: switch to password auth + project README

fix: add 'unsafe-inline' to CSP script-src for token injection

fix: use global variable for token injection (works in incognito iframe)

fix: always overwrite token in localStorage (not only when empty)

fix: set OPENCLAW_VERSION from package.json for correct version display

fix: add dangerouslyDisableDeviceAuth for remote WS connections

fix: use fixed auth token + python-based token injection + restore entrypoint inject

fix: disable auth (mode:none) + patch CSP frame-ancestors for HF iframe embedding

fix: use auth:{} instead of auth:false (object required)

fix: disable gateway auth (HF provides access control), remove token inject hack

fix: move inject-token to runtime entrypoint (build-time injection ignored by OpenClaw)

fix: remove empty apiKey (config invalid), add HF origins to CSP allowedOrigins

perf: node user build (-104s chown), merge RUN layers (-170s), plugin whitelist (-40s)

feat: add timing to all stages, fix OPENROUTER_API_KEY crash, async DNS

deploy: HuggingClaw with original Dockerfile

initial commit