Path A: client switch to issuer token-exchange + strip orphan legacy files
auto-setup.ps1 / bw-ota.ps1: replace anonymous-first + Gitea-credential
dialog branches with issuer token-exchange (auth.bookwormweb.com); embed
public crypto payloads via base64 (no secrets). build.ps1: regenerate
base64 payloads from source at compile time.
Strip 4 zero-reference legacy/admin orphan files (setup-all.js,
patches/admin-cb-routes.js, tools/legacy-gen-launcher-bats.ps1.archive,
create-admin-powershell.bat). Coupled sensitive sources (gen-authcode.js,
admin-authcode-gui.ps1, crypto-helper.js, install.ps1) deferred: still
referenced by build.ps1 -Admin path and auto-setup priority-4 backward-compat
decrypt chain; require dedicated surgery.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
c6f89aad79