Security: VITE_AUTH_ENABLED defaults to 'true' in Dockerfile but 'false' in docs — auth bypass risk