fix: use fixed auth token + python-based token injection + restore entrypoint inject

fix: disable auth (mode:none) + patch CSP frame-ancestors for HF iframe embedding

fix: use auth:{} instead of auth:false (object required)

fix: disable gateway auth (HF provides access control), remove token inject hack

fix: move inject-token to runtime entrypoint (build-time injection ignored by OpenClaw)

fix: remove empty apiKey (config invalid), add HF origins to CSP allowedOrigins

perf: node user build (-104s chown), merge RUN layers (-170s), plugin whitelist (-40s)

feat: add timing to all stages, fix OPENROUTER_API_KEY crash, async DNS

deploy: HuggingClaw with original Dockerfile