login passcode changes

.env.example

@@ -116,7 +116,7 @@ AUTH_LOCKOUT_SECONDS=300
 # token issued is a normal one, so every other guard behaves normally. Unlike
 # AUTH_ENABLED=false it leaves the login page working - it just stops checking
 # the password. Anyone who can reach the port becomes admin: keep it false here.
-AUTH_ALLOW_ANY_LOGIN=false
+AUTH_ALLOW_ANY_LOGIN=true
 
 # Machine consumers of api.<domain> - scripts, partner integrations, your own
 # backends. Format: name:role:secret, comma-separated, role is admin or user.

.env.production

@@ -53,7 +53,7 @@ AUTH_LOCKOUT_SECONDS=300
 # convenience: it skips the password check entirely, so any username signs in
 # and `admin` gets the admin pages. On a host published to the internet it means
 # anyone who finds mcp.nearle.ai.in signs in as admin by typing anything at all.
-AUTH_ALLOW_ANY_LOGIN=false
+AUTH_ALLOW_ANY_LOGIN=true
 
 # Machine consumers. Empty: MCP clients authenticate with a login token instead.
 API_KEYS=