fix(dashboard): gate remote read-only auth

src/commands/docker/up-subcommand.ts

@@ -40,7 +40,7 @@ export async function handleUp(args: string[]): Promise<void> {
     if (parsed.host) {
       console.log(
         info(
-          'Remote access requires dashboard auth. Run inside the container:\n  docker exec -it ccs-cliproxy ccs config auth setup'
+          'Full remote management requires dashboard auth. Without it, remote access stays read-only.\nRun inside the container:\n  docker exec -it ccs-cliproxy ccs config auth setup'
         )
       );
     }

src/web-server/routes/auth-routes.ts

@@ -42,7 +42,17 @@ export function resolveDashboardAccessState(
   const isLocalAccess = isLoopbackRemoteAddress(remoteAddress);
   const authConfigured = Boolean(authConfig.username && authConfig.password_hash);
 
-  if (authConfig.enabled && authConfigured) {
+  if (!authConfig.enabled) {
+    return {
+      authRequired: false,
+      authEnabled: false,
+      authConfigured,
+      isLocalAccess,
+      accessMode: 'open',
+    };
+  }
+
+  if (authConfigured) {
     return {
       authRequired: true,
       authEnabled: true,
@@ -52,19 +62,9 @@ export function resolveDashboardAccessState(
     };
   }
 
-  if (!authConfig.enabled && isLocalAccess) {
-    return {
-      authRequired: false,
-      authEnabled: false,
-      authConfigured,
-      isLocalAccess: true,
-      accessMode: 'open',
-    };
-  }
-
   return {
     authRequired: true,
-    authEnabled: authConfig.enabled,
+    authEnabled: true,
     authConfigured,
     isLocalAccess,
     accessMode: 'setup',