Delete the whole ApiToken stack from the panel: the api_tokens table
model and seed/migrate/normalize paths, the Bearer auth and
admin/monitor scope chain in the panel API (session login is now the
only panel API credential), the settings token-management endpoints,
the CLI -getApiToken bootstrap command, and the SecurityTab token
management UI plus its models/schemas/i18n keys. Regenerate the
frontend OpenAPI files (31 -> 26 schemas).
Agent side untouched: agent runtime, agent version (A2.6.0),
install-agent.sh, subscription/probe paths and node behavior are
unchanged. The /panel/api/agent group never went through checkAPIAuth
and is unaffected.
Also drop provably dead weight found in the same pass: the unimported
internal/xray/geodata package and its generated schemas, the retired
SPA shell routes (/groups, /xray, /outbound, /routing, /api-docs;
unregistered paths still reach the shell via the NoRoute fallback),
the never-set SettingController.xrayService field, and the CSRF
api_authed exemption whose only setter was the deleted Bearer branch.
Deliberately NOT dropped: the api_tokens table itself (left dormant
and empty in existing databases; a DROP migration needs a separate
decision) and the session apiAuthUserKey helper (test-only use remains).
Muse