ops: seed env defaults in installer

scripts/install.sh

@@ -56,6 +56,17 @@ if [[ ! -f "${ENV_FILE}" ]]; then
   sudo chown root:"${SERVICE_GROUP}" "${ENV_FILE}"
 fi
 
+log "Ensuring minimal ENV defaults (PAM always on, allowed user)..."
+DEFAULT_USER="${SUDO_USER:-}"
+if [[ -n "${DEFAULT_USER}" ]]; then
+  if ! sudo grep -q "^SKD_AUTH_ALLOWED_USERS=" "${ENV_FILE}"; then
+    echo "SKD_AUTH_ALLOWED_USERS=${DEFAULT_USER}" | sudo tee -a "${ENV_FILE}" >/dev/null
+  fi
+fi
+if ! sudo grep -q "^SKD_AUTH_MODE=" "${ENV_FILE}"; then
+  echo "SKD_AUTH_MODE=pam" | sudo tee -a "${ENV_FILE}" >/dev/null
+fi
+
 log "Writing systemd unit to ${SYSTEMD_PATH}..."
 sudo tee "${SYSTEMD_PATH}" >/dev/null <<EOF
 [Unit]