Harden remote API security boundaries

scripts/docker-entrypoint.sh

@@ -39,8 +39,14 @@ if [ -f "${SSH_PUBLIC_KEY_PATH}" ]; then
   cat "${SSH_PUBLIC_KEY_PATH}"
 fi
 
-# Handle UI password environment variable
-if [ -n "${UI_PASSWORD:-}" ]; then
+# Handle UI password environment variables. UI_PASSWORD is kept as a legacy
+# alias; OPENCHAMBER_UI_PASSWORD is the canonical runtime variable.
+if [ -z "${OPENCHAMBER_UI_PASSWORD:-}" ] && [ -n "${UI_PASSWORD:-}" ]; then
+  OPENCHAMBER_UI_PASSWORD="$UI_PASSWORD"
+  export OPENCHAMBER_UI_PASSWORD
+fi
+
+if [ -n "${OPENCHAMBER_UI_PASSWORD:-}" ]; then
   echo "[entrypoint] UI password set, enabling authentication"
 fi
 
@@ -69,8 +75,8 @@ if [ "$#" -gt 0 ]; then
 fi
 
 set -- bun packages/web/bin/cli.js
-if [ -n "${UI_PASSWORD:-}" ]; then
-  set -- "$@" --ui-password "$UI_PASSWORD"
+if [ -n "${OPENCHAMBER_UI_PASSWORD:-}" ]; then
+  set -- "$@" --ui-password "$OPENCHAMBER_UI_PASSWORD"
 fi
 "$@"