Add board authentication client and unify server config

README.en.md

@@ -307,8 +307,8 @@ baud_rate = "${env:BAUD_RATE:-115200}"
 
 ```toml
 [board]
-server_ip = "localhost"
-port = 2999
+server = "http://localhost:2999"
+auth_mode = "disabled"
 ```
 
 Use the TUI editor to update it:
@@ -317,7 +317,30 @@ Use the TUI editor to update it:
 ostool board config
 ```
 
-Project-local `.board.toml` `server` / `port` fields still apply to `ostool board run`, with precedence lower than CLI flags and higher than the global config.
+`server` should be a complete URL including `http://` or `https://`; the optional `port` overrides the URL port. For legacy LAN configurations, a bare IPv4 or IPv6 address is interpreted as `http://`; bare host names are not supported, and the removed `server_ip` field is not restored. Project-local `.board.toml` `server` / `port` fields still apply to `ostool board run`, with precedence lower than CLI flags and higher than the global config.
+
+### Public board authentication
+
+Direct LAN connections to `ostool-server` keep the anonymous HTTP configuration above. A public authentication gateway uses a complete HTTPS URL:
+
+```toml
+[board]
+server = "https://203.0.113.10:8443"
+auth_mode = "required"
+```
+
+Sign in through browser device authorization, or import a personal access token (PAT) created in the web UI from standard input:
+
+```bash
+ostool login --server https://203.0.113.10:8443
+printf '%s' "$OSTOOL_PAT" | ostool login --with-token --server https://203.0.113.10:8443
+ostool auth status --server https://203.0.113.10:8443
+ostool logout --server https://203.0.113.10:8443
+```
+
+OAuth sign-in automatically refreshes short-lived access tokens. A PAT is sent directly as a Bearer token and is never refreshed. Credentials are stored in the system credential store when available, with a warned user-level credential-file fallback. Automation can use `OSTOOL_BOARD_ACCESS_TOKEN`; it is neither stored nor refreshed.
+
+Public authentication requires HTTPS. The client verifies certificates only through the system trust store; deployments using a private CA must install its root certificate on client systems. Do not use HTTP, bypass certificate verification, or put tokens in configuration files.
 
 ## 🛠️ Subproject Details
 

README.md

@@ -304,8 +304,8 @@ baud_rate = "${env:BAUD_RATE:-115200}"
 
 ```toml
 [board]
-server_ip = "localhost"
-port = 2999
+server = "http://localhost:2999"
+auth_mode = "disabled"
 ```
 
 可以通过下面的命令打开 TUI 编辑器修改：
@@ -314,7 +314,30 @@ port = 2999
 ostool board config
 ```
 
-项目级 `.board.toml` 中的 `server` / `port` 仍可用于 `ostool board run`，其优先级低于命令行参数，高于全局配置。
+`server` 应使用包含 `http://` 或 `https://` 的完整 URL；可选的 `port` 会覆盖 URL 中的端口。为兼容旧的局域网配置，裸 IPv4 或 IPv6 地址会自动补为 `http://`；不支持无 scheme 的主机名，也不恢复已移除的 `server_ip` 字段。项目级 `.board.toml` 中的 `server` / `port` 仍可用于 `ostool board run`，其优先级低于命令行参数，高于全局配置。
+
+### 公网开发板认证
+
+局域网直接连接 `ostool-server` 时保留上述匿名 HTTP 配置。公网认证网关使用完整 HTTPS 地址：
+
+```toml
+[board]
+server = "https://203.0.113.10:8443"
+auth_mode = "required"
+```
+
+登录使用浏览器设备授权流程，或从标准输入导入在 Web 管理台创建的个人访问令牌（PAT）：
+
+```bash
+ostool login --server https://203.0.113.10:8443
+printf '%s' "$OSTOOL_PAT" | ostool login --with-token --server https://203.0.113.10:8443
+ostool auth status --server https://203.0.113.10:8443
+ostool logout --server https://203.0.113.10:8443
+```
+
+OAuth 登录会自动刷新短期 access token；PAT 直接用于 Bearer 认证，不会刷新。凭据优先保存到系统 credential store；不可用时会警告并退回用户级凭据文件。自动化场景可设置 `OSTOOL_BOARD_ACCESS_TOKEN`，该 token 不保存也不刷新。
+
+公网认证必须使用 HTTPS。客户端仅使用系统信任库验证证书；部署组织私有 CA 时，需由运维将其根证书安装到客户端系统。不要使用 HTTP、跳过证书验证或把 token 放进配置文件。
 
 ## 🛠️ 子项目详解