hub: default to kiosk mode (empty api_key) for the closed LAN

The SPA doesn't send X-API-Key, so a non-empty api_key made the dashboard
401 and show no cameras. Default api_key to "" (no auth) for the closed
travel-router network, consistent with anonymous MQTT. Document the kiosk
decision, the GoPro Hero 3 protocol, and the gotcha that the pull updater
deploys only the binary (config.yaml must be changed on the Pi).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

config.yaml

@@ -4,8 +4,11 @@
 # Database
 db_path: "remoterig.db"
 
-# API Key for endpoint authentication
-api_key: "changeme"
+# API key for endpoint authentication. Empty = kiosk mode (no auth) —
+# intended for the closed travel-router LAN, consistent with anonymous MQTT.
+# Set a value to require the X-API-Key header on /api/v1/* (the SPA would
+# then need it too).
+api_key: ""
 
 # Server settings
 port: 8080