Remove demo seed data and harden API auth

[rogerchappel]

Summary

• Remove seeded demo company, agents, tasks, projects, docs, activity log, and org chart data; seed only the built-in startup blueprint.
• Convert e2e coverage away from seed assumptions by creating explicit fixtures.
• Require session/runtime auth across app-data, runtime, skill, schedule, cron, OpenClaw status, and agent runtime APIs; keep only auth bootstrap, invite validation, health, and GitHub webhook public.
• Update API auth guidance for contributors and CrewCmd skill consumers.

Verification

• pnpm typecheck
• pnpm test
• pnpm lint:check (passes with existing warnings)
• pnpm build (passes with existing middleware/Turbopack trace warnings)
• git diff --check
• rm -rf .data/e2e-pglite test-results && CREWCMD_PGLITE_DATA_DIR=.data/e2e-pglite pnpm db:seed && CREWCMD_PGLITE_DATA_DIR=.data/e2e-pglite pnpm test:e2e
• rm -rf .data/e2e-seed-check && CREWCMD_PGLITE_DATA_DIR=.data/e2e-seed-check pnpm db:seed && CREWCMD_PGLITE_DATA_DIR=.data/e2e-seed-check pnpm db:seed

Notes

• Auth hardening changes are intentionally broad for production readiness; each commit stays within the three-file gate.
• Manual review should focus on logged-in dashboard flows and any external integrations that previously depended on public GET endpoints.