🔧 Remove DISABLE_QUERY_AUTH_TOKEN pin from app.ini 🔧

Gitea 28 still defaults the setting to false, so dropping the explicit
pin changes no behaviour and removes its startup warning. Existing
installs keep whatever they already have; the startup script never
touched this key.

- rootfs/tmp/etc/gitea/app.ini: remove DISABLE_QUERY_AUTH_TOKEN and its explanatory comment from [security]
- TODO.AI.md: note the removal in the Gitea 28 migration entry

Claude-Session: https://claude.ai/code/session_01Kae22tmhzhmfHyqc34PZbx

TODO.AI.md

@@ -23,8 +23,8 @@
   deprecated `[webhook]` key is moved to `[security]`), `[migrations]` host list and `EGRESS_MODE` are
   added only when missing. Dead keys are left in place (ignored by Gitea).
 - Verified with the real image: a fresh install and an upgrade of a real customised config both start with
-  zero `[E]` and, for the upgrade, zero warnings. Kept on purpose: `DISABLE_QUERY_AUTH_TOKEN = false` (an
+  zero `[E]` and, for the upgrade, zero warnings. `DISABLE_QUERY_AUTH_TOKEN = false` pin removed at the
-  earlier deliberate pin) so a fresh install still logs its one warning.
+  owner's request (28 still defaults to false, so no behaviour change; the startup warning is gone).
 - Behaviour now actually in effect (was silently ignored before): `[migrations] SKIP_TLS_VERIFY = true`
   and migrations/mirrors may reach private and loopback hosts. Needs the owner's confirmation.
 

rootfs/tmp/etc/gitea/app.ini

@@ -198,11 +198,6 @@ REVERSE_PROXY_AUTHENTICATION_FULL_NAME                     = X-WEBAUTH-FULLNAME
 X_FRAME_OPTIONS                                            = SAMEORIGIN
 ALLOWED_HOST_LIST                                          = private,loopback
 EGRESS_MODE                                                = lax
-; explicit: defaults to true starting Gitea 1.23 and deprecates ?token=/?access_token=
-; auth entirely in 1.24 — pin false so query-token API calls keep authenticating on
-; upgrade instead of silently downgrading to anonymous; migrate callers to
-; "Authorization: token <token>" when convenient
-DISABLE_QUERY_AUTH_TOKEN                                   = false
 ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 [time]
 DEFAULT_UI_LOCATION                                        = REPLACE_TZ