Release v2.0.2 NPC startup and Client identity fixes

[VAMPIRE0924]

Summary

• allow existing NPC configuration startup to finish when Client configuration upload is disabled, while ignoring all client-reported rules and status
• remove legacy per-Client Web username/password and registration surfaces; retain fixed user + VerifyKey login
• reject empty or duplicate VerifyKeys, rotate legacy empty keys on load, and document the v2.0.2 upgrade/deployment posture

Validation

• production OpenWrt/NPC test confirmed by the user
• ./scripts/mac-verify.sh
• go test ./...
• targeted race tests for bridge/file/runtime/Web packages
• govulncheck v1.7.0 reports 0 reachable vulnerabilities
• local Darwin/Linux/Windows NPS-only release build
• dev Actions run 32797494384 passed and published the multi-architecture dev image

Compatibility

• no NPC binary or configuration rewrite required
• public_vkey legacy public mode remains supported
• the only remaining full-vet finding is the upstream NPC unkeyed net.TCPAddr literal outside the NPS-only release scope