fix: enforce secure control ui auth

src/gateway/test-helpers.server.ts

@@ -101,6 +101,7 @@ export function installGatewayTestHooks() {
     testTailnetIPv4.value = undefined;
     testState.gatewayBind = undefined;
     testState.gatewayAuth = undefined;
+    testState.gatewayControlUi = undefined;
     testState.hooksConfig = undefined;
     testState.canvasHostPort = undefined;
     testState.legacyIssues = [];
@@ -280,7 +281,7 @@ export async function connectReq(
       signature: string;
       signedAt: number;
       nonce?: string;
-    };
+    } | null;
   },
 ): Promise<ConnectResponse> {
   const { randomUUID } = await import("node:crypto");
@@ -294,6 +295,7 @@ export async function connectReq(
   const role = opts?.role ?? "operator";
   const requestedScopes = Array.isArray(opts?.scopes) ? opts?.scopes : [];
   const device = (() => {
+    if (opts?.device === null) return undefined;
     if (opts?.device) return opts.device;
     const identity = loadOrCreateDeviceIdentity();
     const signedAtMs = Date.now();