feat: update authentication defaults to LOCAL

- Changed default AUTH_TYPE in backend configuration to "LOCAL".
- Updated frontend environment configuration to reflect the new default for packaged clients.
- Adjusted runtime authentication resolution to use "LOCAL" as the fallback value.

surfsense_backend/app/config/__init__.py

@@ -762,7 +762,7 @@ class Config:
     TURNSTILE_SECRET_KEY = os.getenv("TURNSTILE_SECRET_KEY", "")
 
     # Auth
-    AUTH_TYPE = os.getenv("AUTH_TYPE")
+    AUTH_TYPE = os.getenv("AUTH_TYPE", "LOCAL")
     REGISTRATION_ENABLED = os.getenv("REGISTRATION_ENABLED", "TRUE").upper() == "TRUE"
 
     # Google OAuth

surfsense_web/lib/env-config.ts

@@ -8,9 +8,9 @@
 
 import packageJson from "../package.json";
 
-// Build-time fallback for packaged clients. Docker runtime reads plain AUTH_TYPE
-// through the runtime config provider first, then falls back to this baked value.
-export const BUILD_TIME_AUTH_TYPE = process.env.NEXT_PUBLIC_AUTH_TYPE || "GOOGLE";
+// Build-time fallback for packaged clients. Docker/runtime deployments default to
+// local auth unless AUTH_TYPE/NEXT_PUBLIC_AUTH_TYPE explicitly selects Google.
+export const BUILD_TIME_AUTH_TYPE = process.env.NEXT_PUBLIC_AUTH_TYPE || "LOCAL";
 
 // Backend API URL. An empty string is valid in proxy mode and means
 // same-origin relative requests (e.g. /api/v1/... and /auth/...).

surfsense_web/lib/runtime-auth-config.ts

@@ -4,7 +4,7 @@ export type RuntimeAuthUiMode = "GOOGLE" | "LOCAL";
 
 export function resolveRuntimeAuthUiMode(
 	value: string | null | undefined,
-	fallback: string | null | undefined = "GOOGLE"
+	fallback: string | null | undefined = "LOCAL"
 ): RuntimeAuthUiMode {
 	const candidate = value?.trim().toUpperCase();
 	if (candidate === "GOOGLE") return "GOOGLE";