Traefik forward-auth with Google OAuth already gates all non-device
routes. The in-app PIN system was redundant. Removes auth middleware,
/api/auth/* endpoints, auth.js from all HTML pages, and SpaxelAuth
references from JS. The auth package remains for install_secret/node
token derivation used by provisioning.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add touch-action: none to canvas elements in expert.css and ambient.css
to prevent passive event listener warnings on iOS Safari
- Add user-scalable=no and maximum-scale=1.0 to viewport meta tags
in ambient.html and simple.html to prevent double-tap zoom
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>