- Eliminated `allow-localhost-unauthenticated` configuration field and its usage. - Removed associated management API handlers and middleware logic. - Simplified authentication middleware by deprecating localhost-specific checks.