feat(cloud): remove static credentials and add host console

.env.example

@@ -8,46 +8,3 @@ POSTGRES_USER=device_cloud
 POSTGRES_PASSWORD=change-me-database-password
 
 CLOUD_API_PORT=8001
-CLOUD_PUBLIC_CREDENTIALS_JSON=[{"principal_id":"local-sdk","token":"change-me-public-token","scopes":["tasks:submit","tasks:read","pool:read","plugins:read","plugins:admin"]}]
-CLOUD_HOST_CREDENTIALS_JSON=[{"principal_id":"local-host-agent","token":"change-me-host-token","scopes":[],"host_id":"host-local"}]
-CLOUD_ENROLLMENT_TOKENS_JSON=[{"principal_id":"edge-installer","token":"change-me-enrollment-token"}]
-# Zero-token self-service Host enrollment (see docs/CLOUD_DEPLOYMENT.md). Only
-# enable this on a deployment whose control-plane URL is not reachable by
-# untrusted networks; any caller that reaches it can register itself as a Host.
-CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED=false
-CLOUD_SCHEDULER_INTERVAL_SECONDS=1
-CLOUD_LEASE_REAPER_INTERVAL_SECONDS=5
-CLOUD_LEASE_DURATION_SECONDS=60
-CLOUD_MAX_TASK_ATTEMPTS=3
-# Browser user sessions are secure-by-default in production. Terminate TLS at a
-# reverse proxy before exposing the Console; do not put initial-user passwords here.
-CLOUD_USER_SESSION_IDLE_SECONDS=28800
-CLOUD_USER_SESSION_ABSOLUTE_SECONDS=604800
-CLOUD_LOGIN_FAILURE_LIMIT=5
-CLOUD_LOGIN_FAILURE_WINDOW_SECONDS=900
-CLOUD_LOGIN_BLOCK_SECONDS=900
-CLOUD_SESSION_COOKIE_SECURE=true
-CLOUD_TRUST_PROXY_HEADERS=false
-
-HOST_AGENT_HOST_ID=host-local
-HOST_AGENT_TOKEN=change-me-host-token
-HOST_AGENT_ENROLLMENT_TOKEN=
-HOST_AGENT_IDENTITY_PATH=/app/tasks/host_identity.json
-# One-time local operator account gate; run `device-host-agent setup`
-# interactively before the daemon's first unattended start (see
-# docs/CLOUD_DEPLOYMENT.md).
-HOST_AGENT_LOCAL_ACCOUNT_PATH=/app/tasks/host_local_account.json
-HOST_AGENT_DISPLAY_NAME=
-HOST_AGENT_TASKS_PATH=./tasks
-HOST_AGENT_HEARTBEAT_INTERVAL_SECONDS=30
-HOST_AGENT_POLL_TIMEOUT_SECONDS=20
-HOST_AGENT_RETRY_BACKOFF_SECONDS=1
-HOST_AGENT_MAX_RETRY_BACKOFF_SECONDS=30
-HOST_AGENT_MAX_RETRY_ATTEMPTS=5
-
-AI_PLANNER_ENABLED=false
-AI_PLANNER_PROVIDER=anthropic
-AI_PLANNER_MODEL=
-AI_PLANNER_TIMEOUT_SECONDS=30
-ANTHROPIC_API_KEY=
-OPENAI_API_KEY=