Add a password-gated private instance mode for xaigen.

Keep Authentik on aigen, isolate library data per instance, and purge Comfy outputs from the desktop after they are saved on the server.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/api/auth/credentials.put.ts

@@ -0,0 +1,17 @@
+export default defineEventHandler(async (event) => {
+  if (!passwordAuthEnabled()) {
+    throw createError({ statusCode: 404, statusMessage: 'Password login is not enabled' })
+  }
+  const user = getSessionUser(event)
+  if (!user) throw createError({ statusCode: 401, statusMessage: 'Authentication required' })
+  const body = await readBody<{ username?: string; password?: string; currentPassword?: string }>(event)
+  const current = String(body?.currentPassword || '')
+  const nextUser = String(body?.username || '').trim()
+  const nextPass = String(body?.password || '')
+  if (!current) throw createError({ statusCode: 400, statusMessage: 'Current password is required' })
+  const matched = await verifyLocalLogin(publicUsername() || user.name || '', current)
+  if (!matched) throw createError({ statusCode: 401, statusMessage: 'Current password is incorrect' })
+  const updated = await updateCredentials(nextUser || matched, nextPass || current)
+  setSessionUser(event, { sub: user.sub, name: updated.username })
+  return { ok: true, username: updated.username }
+})