fix(config): restore 123456 as the default WebUI key

Stop rejecting and auto-rotating the legacy management key so new configs default to 123456 and users can save that value.

src-tauri/src/core_config/settings.rs

@@ -97,9 +97,6 @@ pub(crate) fn validate_strong_management_secret_key(secret_key: &str) -> Result<
     if secret_key.trim().is_empty() {
         return Err("WebUI key cannot be empty".to_string());
     }
-    if secret_key.trim() == LEGACY_DEFAULT_MANAGEMENT_SECRET_KEY {
-        return Err("The legacy default WebUI key 123456 cannot be used".to_string());
-    }
     if is_hashed_management_secret_key(secret_key) {
         return Err("GUI configuration must save a plaintext WebUI key that can authenticate with the management interface".to_string());
     }
@@ -116,9 +113,7 @@ pub(crate) fn generate_management_secret_key() -> Result<String, String> {
 
 pub(crate) fn management_secret_requires_rotation(secret_key: &str) -> bool {
     let secret_key = secret_key.trim();
-    secret_key.is_empty()
-        || secret_key == LEGACY_DEFAULT_MANAGEMENT_SECRET_KEY
-        || is_hashed_management_secret_key(secret_key)
+    secret_key.is_empty() || is_hashed_management_secret_key(secret_key)
 }
 
 pub(crate) fn ensure_strong_management_secret(config: &mut GuiConfigFile) -> Result<bool, String> {

src-tauri/src/main.rs

@@ -911,7 +911,7 @@ impl Default for GuiConfigFile {
             auth_dir: DEFAULT_AUTH_DIR.to_string(),
             api_keys: vec![default_api_key_entry()],
             api_access_remarks: Vec::new(),
-            management_secret_key: String::new(),
+            management_secret_key: LEGACY_DEFAULT_MANAGEMENT_SECRET_KEY.to_string(),
             debug: false,
             commercial_mode: false,
             logging_to_file: false,

src-tauri/src/tests/core_config.rs

@@ -109,30 +109,40 @@ fn webui_management_secret_requires_a_non_empty_plaintext_value() {
     )
     .is_err());
     assert!(normalize_management_secret_key("bad\nsecret".to_string()).is_err());
-    assert!(normalize_management_secret_key("123456".to_string()).is_err());
+    assert_eq!(
+        normalize_management_secret_key("  123456  ".to_string()).unwrap(),
+        "123456"
+    );
 }
 
 #[test]
-fn management_secret_rotation_replaces_legacy_values_and_preserves_custom_values() {
-    let mut fresh = GuiConfigFile::default();
-    assert!(ensure_strong_management_secret(&mut fresh).unwrap());
-    assert!(fresh.management_secret_key.starts_with("wui-Aa9_"));
-    assert!(fresh.management_secret_key.len() >= 50);
+fn management_secret_rotation_replaces_empty_values_and_preserves_custom_values() {
+    let fresh = GuiConfigFile::default();
+    assert_eq!(
+        fresh.management_secret_key,
+        LEGACY_DEFAULT_MANAGEMENT_SECRET_KEY
+    );
     assert!(!management_secret_requires_rotation(
         &fresh.management_secret_key
     ));
 
-    let first_generated = fresh.management_secret_key.clone();
+    let mut empty = GuiConfigFile {
+        management_secret_key: String::new(),
+        ..GuiConfigFile::default()
+    };
+    assert!(ensure_strong_management_secret(&mut empty).unwrap());
+    assert!(empty.management_secret_key.starts_with("wui-Aa9_"));
+    assert!(empty.management_secret_key.len() >= 50);
+
     let mut legacy = GuiConfigFile {
         management_secret_key: LEGACY_DEFAULT_MANAGEMENT_SECRET_KEY.to_string(),
         ..GuiConfigFile::default()
     };
-    assert!(ensure_strong_management_secret(&mut legacy).unwrap());
-    assert_ne!(
+    assert!(!ensure_strong_management_secret(&mut legacy).unwrap());
+    assert_eq!(
         legacy.management_secret_key,
         LEGACY_DEFAULT_MANAGEMENT_SECRET_KEY
     );
-    assert_ne!(legacy.management_secret_key, first_generated);
 
     let mut hashed = GuiConfigFile {
         management_secret_key: "$2a$10$abcdefghijklmnopqrstuuuuuuuuuuuuuuuuuuuuuuuuuuuuu"