Why: a non-nil Authenticator with Enabled=false is the embedded no-auth
mode; reporting auth=true there made the sidebar account footer show
the wrong identity state (found in the live headless walk).
Evidence: restarted binary now returns {"auth":false,...} in embedded
mode; TestTaskListAndFlags still green.
Impact: response field value only.
weichen
5871c3e771