feat: fleet secret auth - zero-setup agent authentication, dashboard WS token, remove credential hints

server/config.go

@@ -43,6 +43,9 @@ type ServerSettings struct {
 	SignCertThumbprint     string `json:"sign_cert_thumbprint"`
 	SignToolPath           string `json:"sign_tool_path"`
 	SignTimestampURL       string `json:"sign_timestamp_url"`
+	// FleetSecret is a random token generated once on first run and baked into
+	// every forged agent binary. Agents must present it on connect or be rejected.
+	FleetSecret string `json:"fleet_secret"`
 }
 
 type PoolConfig struct {
@@ -549,6 +552,9 @@ func mergeConfigExplicit(dst, src *Config, present map[string]json.RawMessage) {
 		if src.Server.SignTimestampURL != "" {
 			dst.Server.SignTimestampURL = src.Server.SignTimestampURL
 		}
+		if src.Server.FleetSecret != "" {
+			dst.Server.FleetSecret = src.Server.FleetSecret
+		}
 	}
 }