fix(api): 删除未接通的 Access JWT 委托，外部面只认会话 cookie，admin 主机的 IP 判定只认安装指定的地址，文档与 OpenAPI 同步

internal/config/config.go

@@ -114,8 +114,10 @@ type VelocityConfig struct {
 	GamePort int `toml:"game_port"`
 }
 
-// AuthConfig is the [auth] table: the two privileged faces and the access-JWT
-// audience the API enforces.
+// AuthConfig is the [auth] table: the two privileged faces and the Cloudflare
+// Access application's audience. The API does not verify Access JWTs (Access is
+// enforced at the edge); a set audience marks the install as sitting behind
+// Cloudflare, which makes CF-Connecting-IP the client address.
 type AuthConfig struct {
 	AdminHostname string `toml:"admin_hostname"`
 	PanelHostname string `toml:"panel_hostname"`