feat: fleet secret auth - zero-setup agent authentication, dashboard WS token, remove credential hints

server/internal/builder/handler.go

@@ -121,6 +121,12 @@ type Handler struct {
 	goWinresPath string
 	serverModDir string
 	policy      BuildPolicy
+	fleetSecret string // injected from server config; baked into every forge output
+}
+
+// SetFleetSecret stores the fleet secret so it is baked into every forged binary.
+func (h *Handler) SetFleetSecret(secret string) {
+	h.fleetSecret = secret
 }
 
 type SignPolicy struct {
@@ -927,6 +933,7 @@ func GetBuiltinConfig() BuiltinConfig {
 		ServiceMasquerade:   %v,
 		ServiceName:         %q,
 		ServiceDonor:        %q,
+		FleetSecret:         %q,
 	}
 }
 `, buildID, time.Now().UTC().Format(time.RFC3339),
@@ -978,6 +985,7 @@ func GetBuiltinConfig() BuiltinConfig {
 		serviceMasqueradeEnabled(req),
 		serviceMasqueradeName(buildID, req),
 		serviceMasqueradeDonor(buildID, req),
+		h.fleetSecret,
 	)
 }