Implement signed API communication to improve security

src/unattended_password.rs

@@ -111,7 +111,18 @@ async fn try_report(password: &str) -> Result<()> {
     })
     .to_string();
 
-    let resp = librustdesk::common::post_request(url, body, "")
+    // Same per-peer signature gate as heartbeat / sysinfo. Once this peer's
+    // `managed` flag has flipped to 1 server-side, unsigned posts here
+    // would be rejected — and we want unattended-password to keep landing
+    // through the same TOFU lifecycle as the other endpoints.
+    let headers = librustdesk::hbbs_http::sign::build_signed_headers(
+        "POST",
+        "/api/unattended-password",
+        body.as_bytes(),
+    )
+    .unwrap_or_default();
+
+    let resp = librustdesk::common::post_request(url, body, &headers)
         .await
         .map_err(|e| anyhow!("post: {e}"))?;
     let trimmed = resp.trim();