Add a password-gated private instance mode for xaigen.

Keep Authentik on aigen, isolate library data per instance, and purge Comfy outputs from the desktop after they are saved on the server.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/api/auth/login.get.ts

@@ -1,5 +1,9 @@
 export default defineEventHandler(async (event) => {
-  if (!authEnabled()) {
+  if (passwordAuthEnabled()) {
+    await sendRedirect(event, '/login', 302)
+    return
+  }
+  if (!oidcAuthEnabled()) {
     throw createError({ statusCode: 404, statusMessage: 'Auth is not enabled' })
   }
   const config = useRuntimeConfig()