fix(security): fail closed in production; arm registry auth by default

GHSA-4f7g-w95g-5q2c (CVSS 9.8) — the default registry deploy ran in
header-trust mode: with ROBOCO_AGENT_AUTH_REQUIRED unset and cloud auth
off, require_panel_token / _check_agent_auth_token returned without
verifying a credential, so any client reaching the API could write
settings and claim X-Agent-Role: ceo with no token. Binding :8000 to
loopback (c4053d5f) closed the direct path but not nginx :3000, which
proxies /api/ to the orchestrator and passes client X-Agent-* through.

Root cause: header-trust is the default even in production. _auth_required
now fails closed when settings.environment == production (the registry
compose already declares it) — an explicit false still opts out for a
trusted private network. The registry compose arms auth by default and
requires ROBOCO_PANEL_AGENT_TOKEN so nginx injects a valid CEO token and
the panel keeps working. The CEO's NAS deploy is unaffected: it runs
cloud auth, which already enforced tokens on every role.

docker-compose.registry.yml

@@ -314,7 +314,12 @@ services:
       ROBOCO_PORT: 8000
       ROBOCO_ENCRYPTION_KEY: ${ROBOCO_ENCRYPTION_KEY:?ROBOCO_ENCRYPTION_KEY is required}
       ROBOCO_AGENT_AUTH_SECRET: ${ROBOCO_AGENT_AUTH_SECRET:?ROBOCO_AGENT_AUTH_SECRET is required}
-      ROBOCO_AGENT_AUTH_REQUIRED: ${ROBOCO_AGENT_AUTH_REQUIRED:-false}
+      # Fail closed by default (GHSA-4f7g-w95g-5q2c): this deploy is
+      # ROBOCO_ENVIRONMENT=production, and header-trust off a network-reachable
+      # port lets any client claim X-Agent-Role: ceo. nginx injects the CEO
+      # token below so the panel keeps working. Set false only on a trusted
+      # private network with no untrusted reach to nginx.
+      ROBOCO_AGENT_AUTH_REQUIRED: ${ROBOCO_AGENT_AUTH_REQUIRED:-true}
       ROBOCO_LOCAL_LLM_BASE_URL: http://roboco-ollama:11434/v1
       ROBOCO_LOCAL_LLM_MODEL: glm-5.2:cloud
       ROBOCO_DEFAULT_EMBEDDING_MODEL: qwen3-embedding:0.6b
@@ -476,7 +481,10 @@ services:
     ports:
       - "3000:80"
     environment:
-      ROBOCO_PANEL_AGENT_TOKEN: ${ROBOCO_PANEL_AGENT_TOKEN:-}
+      # Required when cloud auth is off: with auth armed, nginx must inject a
+      # valid CEO token or the panel is locked out (GHSA-4f7g-w95g-5q2c). Mint
+      # one with the agent-auth secret; see docs/backend/ops.
+      ROBOCO_PANEL_AGENT_TOKEN: ${ROBOCO_PANEL_AGENT_TOKEN:?ROBOCO_PANEL_AGENT_TOKEN is required (mint a CEO token from ROBOCO_AGENT_AUTH_SECRET) unless ROBOCO_CLOUD_AUTH_ENABLED=true}
       NGINX_ENVSUBST_FILTER: "^ROBOCO_"
     volumes:
       - ./docker/nginx.conf:/etc/nginx/templates/default.conf.template:ro