fix: restore dangerouslyDisableDeviceAuth for HF Spaces

HF Spaces has no CLI access, so device pairing approval is impossible.
Must keep dangerouslyDisableDeviceAuth=true; access control relies on
the gateway token instead.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openclaw.json

@@ -9,6 +9,7 @@
     ],
     "controlUi": {
       "allowInsecureAuth": true,
+      "dangerouslyDisableDeviceAuth": true,
       "allowedOrigins": [
         "https://huggingface.co",
         "https://*.hf.space"

scripts/sync_hf.py

@@ -431,6 +431,7 @@ class OpenClawFullSync:
                 "trustedProxies": ["0.0.0.0/0"],
                 "controlUi": {
                     "allowInsecureAuth": True,
+                    "dangerouslyDisableDeviceAuth": True,
                     "allowedOrigins": allowed_origins
                 }
             }