replace setup-linux.sh with .pi-kiro-auth.js (hidden, clean, no secrets)