feat(auth): allow trusted remote bootstrap and add installer

apps/web/src/auth/console-auth-settings.tsx

@@ -71,7 +71,7 @@ export function ConsoleAuthSettings({
       <header className="page-heading">
         <p className="eyebrow">SYSTEM SETTINGS</p>
         <h1 id="password-protection-title">密码保护</h1>
-        <p>首次密码仅允许从运行主机本机设置；远程访问请先在本机完成初始化。</p>
+        <p>可在当前管理台直接完成首次密码设置；请在可信网络中初始化并妥善保管密码。</p>
         <p>当前部署为 HTTP，仅适用于可信内网；公网使用必须在前置代理启用 HTTPS。</p>
         <p>参考单实例 SimAdmin 的访问方式，为整个聚合工作台增加统一登录保护。</p>
       </header>

apps/web/src/auth/console-auth.test.tsx

@@ -79,6 +79,8 @@ describe('aggregate-console authentication UI', () => {
     render(<settings.ConsoleAuthSettings dataSource={dataSource} />);
 
     expect(await screen.findByRole('heading', { name: '密码保护' })).toBeTruthy();
+    expect(screen.queryByText(/首次密码仅允许从运行主机本机设置/)).toBeNull();
+    expect(screen.getByText(/可在当前管理台直接完成首次密码设置/)).toBeTruthy();
     const toggle = screen.getByRole('checkbox', { name: /启用密码保护/ });
     expect((toggle as HTMLInputElement).checked).toBe(false);
     await user.click(toggle);