feat(arbo): disable ENGINE_TOKEN bearer auth on prod (WireGuard = boundary)

Operator decision 2026-06-13 (relayed by comfy-dev, confirmed in-session):
turn off the prod arbo engine's bearer auth and rely on the WireGuard
perimeter. Reverses ADR-0001's open-auth-hole-closed posture (comfy-dev owns
the ADR update on the vh/arbo side).

The app's protected-gate no-ops only when ENGINE_TOKEN is ABSENT — an empty
string still gates (verified: ENGINE_TOKEN="" -> /workflows 401). So both
inject paths are removed: the compose environment line is commented out and
the .env line deleted on the host. Result: tokenless GET /workflows 200 (was
401), matching the dev engine. Original token preserved in the host's
.env.pre-auth-off.bak for re-enable.

playbooks/arbo-disable-engine-token.yaml captures the reversible procedure.

stacks/arbo/compose.yaml

@@ -48,7 +48,12 @@ services:
       # LiteLLM gateway for the granite hero/metadata calls:
       - GRANITE_ENDPOINT=http://10.250.50.70:4000/v1
       - GRANITE_KEY=${GRANITE_KEY}              # arbo-prompt-enhance scoped vkey (.env)
-      - ENGINE_TOKEN=${ENGINE_TOKEN}            # real bearer — closes today's open auth (.env)
+      # ENGINE_TOKEN intentionally NOT injected — bearer auth is OFF on prod by
+      # operator decision (2026-06-13); WireGuard is the access boundary. The
+      # app's protected-gate no-ops only when the var is ABSENT — an empty string
+      # still gates — so it must not be set here OR in .env. Re-enable: restore
+      # this line + set ENGINE_TOKEN in .env, then `compose up -d`. Reverses ADR-0001.
+      #- ENGINE_TOKEN=${ENGINE_TOKEN}
     volumes:
       - arbo_db:/data
       - arbo_heroes:/heroes