The Settings -> Security toggles (Allow Remote Full Access, Allow HTTP Token Transport, Require Token For All Writes) were persisted in the DB but ignored by _check_write_access() and the bootstrap-token endpoint, which only read MAJOOR_* env vars. Remote LAN clients hit 'Write access is blocked' even with all toggles enabled.
- New security_prefs_snapshot module: thread-safe in-memory snapshot of persisted prefs, hydrated at ensure_security_bootstrap() and republished on every set_security_prefs(). Read synchronously by guards.
- security.py::_resolve_security_flag(pref_key, env_var, default): single read site, snapshot-first / env-fallback. Used for allow_remote_write, require_auth, allow_insecure_token_transport.
- _bootstrap_enabled() also returns True when allow_remote_write is set in the snapshot (UI consent for remote bootstrap).
- bootstrap-token / rotate-token accept plain HTTP transport when allow_insecure_token_transport is on.
- Friendlier defaults so first install works zero-config on LAN: allow_remote_write=True, allow_insecure_token_transport=True. Auto-generated API token still gates writes.
- Error messages updated to point users to Settings -> Security instead of only env vars.
- README rewritten to put the UI flow first; env vars as headless fallback.
- pyproject.toml: per-file ignore F401 for routes/core/security.py since it is the single import point that re-exports from sub-modules.
Ewald
0894657274