Add a password-gated private instance mode for xaigen.

Keep Authentik on aigen, isolate library data per instance, and purge Comfy outputs from the desktop after they are saved on the server.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/api/auth/login.post.ts

@@ -0,0 +1,17 @@
+export default defineEventHandler(async (event) => {
+  if (!passwordAuthEnabled()) {
+    throw createError({ statusCode: 404, statusMessage: 'Password login is not enabled' })
+  }
+  assertLoginAllowed(event)
+  const body = await readBody<{ username?: string; password?: string }>(event)
+  const username = String(body?.username || '')
+  const password = String(body?.password || '')
+  const matched = await verifyLocalLogin(username, password)
+  if (!matched) {
+    recordLoginFailure(event)
+    throw createError({ statusCode: 401, statusMessage: 'Incorrect username or password' })
+  }
+  clearLoginFailures(event)
+  setSessionUser(event, { sub: `local:${privateInstanceId()}`, name: matched })
+  return { ok: true, user: { name: matched } }
+})