🔧 Remove DISABLE_QUERY_AUTH_TOKEN pin from app.ini 🔧

Gitea 28 still defaults the setting to false, so dropping the explicit
pin changes no behaviour and removes its startup warning. Existing
installs keep whatever they already have; the startup script never
touched this key.

- rootfs/tmp/etc/gitea/app.ini: remove DISABLE_QUERY_AUTH_TOKEN and its explanatory comment from [security]
- TODO.AI.md: note the removal in the Gitea 28 migration entry

Claude-Session: https://claude.ai/code/session_01Kae22tmhzhmfHyqc34PZbx

rootfs/tmp/etc/gitea/app.ini

@@ -198,11 +198,6 @@ REVERSE_PROXY_AUTHENTICATION_FULL_NAME                     = X-WEBAUTH-FULLNAME
 X_FRAME_OPTIONS                                            = SAMEORIGIN
 ALLOWED_HOST_LIST                                          = private,loopback
 EGRESS_MODE                                                = lax
-; explicit: defaults to true starting Gitea 1.23 and deprecates ?token=/?access_token=
-; auth entirely in 1.24 — pin false so query-token API calls keep authenticating on
-; upgrade instead of silently downgrading to anonymous; migrate callers to
-; "Authorization: token <token>" when convenient
-DISABLE_QUERY_AUTH_TOKEN                                   = false
 ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 [time]
 DEFAULT_UI_LOCATION                                        = REPLACE_TZ