bug(auth): frontend + Ansible still gate on single_user after #10713 forced backend auth ON — cross-stack inconsistency #10861

Discovered during #10713

#10713 permanently retired the single_user auth-disable branch in security_layer.py — the backend now ALWAYS enables auth (enable_auth = security_config.get('enable_auth', True)). But the rest of the stack still treats single_user as a live mode, so a single_user-configured deployment now has auth forced on in the backend while the frontend/Ansible still believe auth is disabled → 401s / mismatched UX.

Evidence (still referencing single_user)

Frontend (10 files): App.vue, stores/useUserStore.ts, stores/useRuntimeFeaturesStore.ts, stores/useLlcCompanyStore.ts, stores/useChatStore.ts, composables/useServiceDiscovery.ts, router/index.ts, views/llc/CompanySelectorView.vue, models/repositories/ChatRepository.ts, utils/ApiClient.ts.
Ansible (7 files): roles/backend/templates/backend.env.j2, roles/backend/defaults/main.yml, roles/backend/tasks/main.yml, setup-user-backend.yml, playbooks/provision-backend-db-single-box.yml, playbooks/update-all-nodes.yml, inventory/group_vars/backend.yml.

Fix

Complete the single_user elimination across frontend + Ansible per the 'always full user management' rule: stop provisioning AUTOBOT_USER_MODE=single_user, remove single_user nav/gating branches (wire to full-user-management defaults, don't leave dead), and stop emitting single_user in env templates.

Consolidation opportunity (do while here)

user_mode is compared as raw string literals ("single_user") in both backends and ~10 frontend files. If any user-mode gating survives the cleanup, centralize it: a backend UserMode enum/constant and a single frontend composable (e.g. useUserMode()) instead of scattered string checks across stores/router/App.vue.

Relates to #10713, #10202 (503-gate removal), #10193 (auth-unify epic), #10636 (single-box umbrella).