fix: apply the review items for #718 at merge

- docs/api-reference.md:1222: the tunnel status shape is { running, url, loginConfigured } (getStatus() returns only running and url)
- src/web/routes/system-routes.ts:1233: the unauthenticated-tunnel warning keys on !isLoginConfigured(), so it no longer fires in multi-user mode
- test/install-sh-invariants.test.ts:537: install.sh must not contain --allow-unauthenticated-tunnel either (it writes service argv as well as env)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/web/routes/system-routes.ts

@@ -1228,9 +1228,9 @@ export function registerSystemRoutes(
             reply.code(403);
             return createErrorResponse(ApiErrorCode.OPERATION_FAILED, unauthenticatedTunnelRefusal(true));
           }
-          // Loud warning whenever a public tunnel is started with no password, whether
+          // Loud warning whenever a public tunnel is started with no login in front of it, whether
           // acknowledged via the tunnel opt-in or the per-request UI confirmation.
-          if (!process.env.CODEMAN_PASSWORD) {
+          if (!isLoginConfigured()) {
             console.warn(
               '⚠️  [tunnel] Starting an UNAUTHENTICATED public Cloudflare tunnel — no CODEMAN_PASSWORD set. ' +
                 'Anyone with the tunnel URL gets full terminal control (effectively RCE). ' +