feat(cloud): remove static credentials and add host console

cloud-console/README.md

@@ -6,10 +6,6 @@ expiring, revocable `HttpOnly` session cookie, while the frontend sends the
 separate CSRF cookie value on writes. The browser never stores the session
 secret in JavaScript.
 
-The login screen also offers **Use API token** for existing break-glass or
-automation credentials. That token is held only in `sessionStorage`; it remains
-compatible with the existing scoped `CLOUD_PUBLIC_CREDENTIALS_JSON` model.
-
 ## Prerequisites
 
 - Node.js 20+
@@ -22,7 +18,7 @@ Accounts have fixed roles:
 
 - `viewer`: task, device/host, and plugin read views
 - `operator`: viewer access plus task submission APIs
-- `admin`: all API scopes and the Console Users view
+- `admin`: all API scopes
 
 ## Local development
 
@@ -48,10 +44,7 @@ The Console uses `credentials: include`. `401` returns to the login screen;
 ## Production
 
 `npm run build` type-checks and creates `dist/`. The repository Dockerfile
-already builds this bundle into `/app/console-static`; `compose.yaml` and
-`compose.deploy.yaml` mount it at the same-origin `/console/` route. No CORS
-configuration is required in that deployment shape.
-
-Administrators can create users, assign roles, enable/disable accounts, reset
-temporary passwords, and revoke sessions. All password inputs are cleared from
-the UI after a create/reset request succeeds or fails.
+already builds this bundle into `/app/console-static` and configures the Cloud
+API to serve it at the same-origin `/console/` route. No CORS configuration is
+required in that deployment shape. Use `device-cloud-admin` for account
+provisioning and recovery.