fix: remove unsupported gateway auth off option

src/wizard/onboarding.gateway-config.ts

@@ -93,11 +93,6 @@ export async function configureGatewayForOnboarding(
       : ((await prompter.select({
           message: "Gateway auth",
           options: [
-            {
-              value: "off",
-              label: "Off (loopback only)",
-              hint: "Not recommended unless you fully trust local processes",
-            },
             {
               value: "token",
               label: "Token",
@@ -165,7 +160,6 @@ export async function configureGatewayForOnboarding(
 
   // Safety + constraints:
   // - Tailscale wants bind=loopback so we never expose a non-loopback server + tailscale serve/funnel at once.
-  // - Auth off only allowed for bind=loopback.
   // - Funnel requires password auth.
   if (tailscaleMode !== "off" && bind !== "loopback") {
     await prompter.note("Tailscale requires bind=loopback. Adjusting bind to loopback.", "Note");
@@ -173,11 +167,6 @@ export async function configureGatewayForOnboarding(
     customBindHost = undefined;
   }
 
-  if (authMode === "off" && bind !== "loopback") {
-    await prompter.note("Non-loopback bind requires auth. Switching to token auth.", "Note");
-    authMode = "token";
-  }
-
   if (tailscaleMode === "funnel" && authMode !== "password") {
     await prompter.note("Tailscale funnel requires password auth.", "Note");
     authMode = "password";

src/wizard/onboarding.ts

@@ -244,7 +244,6 @@ export async function runOnboardingWizard(
       return "Auto";
     };
     const formatAuth = (value: GatewayAuthChoice) => {
-      if (value === "off") return "Off (loopback only)";
       if (value === "token") return "Token (default)";
       return "Password";
     };