Update start.sh

fix: remove environment= from supervisord to preserve HF secrets (password)

fix: add --allow-root flag for JupyterLab running as root

Set root_dir=/ so file browser + terminal can navigate entire filesystem

cd to /data before launching JupyterLab so terminal cwd matches file browser

Add password gate (nginx + Flask auth) in front of token-less JupyterLab

Add JupyterLab setup (Docker SDK, CPU)