feat: fleet secret auth - zero-setup agent authentication, dashboard WS token, remove credential hints

server/web/src/components/SessionGate.tsx

@@ -4,7 +4,7 @@ import { getStoredAuth, setStoredAuth } from '../api/auth';
 export default function SessionGate({ children }: { children: ReactNode }) {
   const [ready, setReady] = useState(false);
   const [authed, setAuthed] = useState(!!getStoredAuth());
-  const [user, setUser] = useState('drjones');
+  const [user, setUser] = useState('');
   const [pass, setPass] = useState('');
   const [err, setErr] = useState('');
 
@@ -72,7 +72,6 @@ export default function SessionGate({ children }: { children: ReactNode }) {
           <button type="submit" className="btn btn-primary btn-lg">
             Enter Command Deck
           </button>
-          <p className="form-hint">Default: drjones / czapiewski (change under Calibrate → Users)</p>
         </form>
       </div>
     );

server/web/src/context/WebSocketProvider.tsx

@@ -9,6 +9,7 @@ import type {
 import type { Agent, Share, FleetAlert, PoolStatus, AIActivityEntry, WSMessage } from '../types';
 import { WebSocketContext } from './WebSocketContext';
 import type { SeqCommandResult } from './WebSocketContext';
+import { getStoredAuth } from '../api/auth';
 
 /**
  * WebSocketProvider mounts a SINGLE WebSocket connection for the whole app.
@@ -45,7 +46,8 @@ export function WebSocketProvider({ children }: { children: React.ReactNode }) {
     }
 
     const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
-    const wsUrl = `${protocol}//${window.location.host}/ws/dashboard`;
+    const token = getStoredAuth();
+    const wsUrl = `${protocol}//${window.location.host}/ws/dashboard${token ? `?token=${encodeURIComponent(token)}` : ''}`;
     const ws = new WebSocket(wsUrl);
     wsRef.current = ws;