revert: restore token auth + dangerouslyDisableDeviceAuth=true

Password auth also fails — auto-pairing only grants operator.read.
This is OpenClaw upstream bug (openclaw/openclaw#22226, #17187).
The A2A bridge correctly implements the full WS protocol but cannot
get operator.write scope through any auth method.

Reverting to the working config. A2A dispatch falls back to direct
LLM API calls via conversation-loop.py's call_llm_fallback().

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/sync_hf.py

@@ -430,11 +430,11 @@ class OpenClawFullSync:
                 "mode": "local",
                 "bind": "lan",
                 "port": 7860,
-                "auth": {"password": GATEWAY_TOKEN},
+                "auth": {"token": GATEWAY_TOKEN},
                 "trustedProxies": ["0.0.0.0/0"],
                 "controlUi": {
                     "allowInsecureAuth": True,
-                    "dangerouslyDisableDeviceAuth": False,
+                    "dangerouslyDisableDeviceAuth": True,
                     "allowedOrigins": allowed_origins
                 }
             }

scripts/token-redirect.cjs

@@ -337,7 +337,7 @@ function handleA2ABridge(req, res) {
         wsSend(wsSocket, JSON.stringify({
           type: 'req', id: 'connect-' + Date.now(), method: 'connect',
           params: {
-            auth: { password: GATEWAY_TOKEN },
+            auth: { token: GATEWAY_TOKEN },
             client: { id: 'gateway-client', platform: 'node', mode: 'backend', version: '1.0.0' },
             minProtocol: 3,
             maxProtocol: 3,