feat: Simplify AutoStart and fix critical security vulnerability

Major architectural improvements:
- Remove complex plaintext cache system, use direct database fields
- Replace IP-based authentication with secure token-based auth
- Integrate INTERNAL_AUTH_TOKEN with unified auto-generation system

Security fixes:
- Fix Docker nginx proxy authentication bypass vulnerability in /ssh/db/host/internal
- Replace req.ip detection with X-Internal-Auth-Token header validation
- Add production environment security checks for internal auth token

AutoStart simplification:
- Add autostart_{password,key,key_password} columns directly to ssh_data table
- Remove redundant autostartPlaintextCache table and AutoStartPlaintextManager
- Implement enable/disable/status endpoints for autostart management
- Update frontend to handle autostart cache lifecycle automatically

Environment variable improvements:
- Integrate INTERNAL_AUTH_TOKEN into SystemCrypto auto-generation
- Unified .env file management for all security keys (JWT, Database, Internal Auth)
- Auto-generate secure tokens with proper entropy (256-bit)

API improvements:
- Make /users/oidc-config and /users/registration-allowed public for login page
- Add /users/setup-required endpoint replacing problematic getUserCount usage
- Restrict /users/count to admin-only access for security

Database schema:
- Add autostart plaintext columns to ssh_data table with proper migrations
- Remove complex cache table structure for simplified data model

src/backend/starter.ts

@@ -8,6 +8,7 @@ import path from "path";
 import { AutoSSLSetup } from "./utils/auto-ssl-setup.js";
 import { AuthManager } from "./utils/auth-manager.js";
 import { DataCrypto } from "./utils/data-crypto.js";
+import { SystemCrypto } from "./utils/system-crypto.js";
 import { systemLogger, versionLogger } from "./utils/logger.js";
 
 (async () => {
@@ -74,6 +75,15 @@ import { systemLogger, versionLogger } from "./utils/logger.js";
         securityIssues.push("DATABASE_KEY should be at least 64 characters in production");
       }
 
+      if (!process.env.INTERNAL_AUTH_TOKEN) {
+        systemLogger.warn("INTERNAL_AUTH_TOKEN not set - using auto-generated token (consider setting for production)", {
+          operation: "security_warning",
+          note: "Auto-generated tokens are secure but not persistent across deployments"
+        });
+      } else if (process.env.INTERNAL_AUTH_TOKEN.length < 32) {
+        securityIssues.push("INTERNAL_AUTH_TOKEN should be at least 32 characters in production");
+      }
+
       // Check database file encryption
       if (process.env.DB_FILE_ENCRYPTION === 'false') {
         securityIssues.push("Database file encryption should be enabled in production");
@@ -114,7 +124,14 @@ import { systemLogger, versionLogger } from "./utils/logger.js";
     const authManager = AuthManager.getInstance();
     await authManager.initialize();
     DataCrypto.initialize();
-    systemLogger.info("Security system initialized (KEK-DEK architecture)", {
+
+    // Initialize system crypto keys (JWT, Database, Internal Auth)
+    const systemCrypto = SystemCrypto.getInstance();
+    await systemCrypto.initializeJWTSecret();
+    await systemCrypto.initializeDatabaseKey();
+    await systemCrypto.initializeInternalAuthToken();
+
+    systemLogger.info("Security system initialized (KEK-DEK architecture + SystemCrypto)", {
       operation: "security_init",
     });