feat(FN-2585): remove top-level remote access toggle

- Remove the standalone remoteEnabled setting from CLI, core settings defaults/types, and dashboard settings APIs/UI
- Treat remote access as enabled when an active provider is selected and that provider is configured as enabled
- Update remote auth and engine lifecycle checks to gate on provider activation instead of a global flag
- Adjust tests and add a changeset documenting the remote access configuration simplification

packages/dashboard/app/api/legacy.ts

@@ -404,7 +404,6 @@ export function updateSettings(settings: Partial<Settings>, projectId?: string):
 }
 
 export interface RemoteSettings {
-  remoteEnabled: boolean;
   remoteActiveProvider: "tailscale" | "cloudflare" | null;
   remoteTailscaleEnabled: boolean;
   remoteTailscaleHostname: string;

packages/dashboard/app/components/SettingsModal.tsx

@@ -1244,7 +1244,6 @@ export function SettingsModal({
 
   const handleSaveRemoteSettings = useCallback(async () => {
     const nextSettings: Partial<RemoteSettings> = {
-      remoteEnabled: Boolean((form as Record<string, unknown>).remoteEnabled),
       remoteActiveProvider: ((form as Record<string, unknown>).remoteActiveProvider as "tailscale" | "cloudflare" | null) ?? null,
       remoteTailscaleEnabled: Boolean((form as Record<string, unknown>).remoteTailscaleEnabled),
       remoteTailscaleHostname: String((form as Record<string, unknown>).remoteTailscaleHostname ?? ""),
@@ -3411,19 +3410,6 @@ export function SettingsModal({
             {renderScopeBanner()}
             <h4 className="settings-section-heading">Remote Access</h4>
 
-            <div className="form-group">
-              <label htmlFor="remoteEnabled" className="checkbox-label">
-                <input
-                  id="remoteEnabled"
-                  type="checkbox"
-                  checked={Boolean(remoteForm.remoteEnabled)}
-                  onChange={(e) => setForm((f) => ({ ...f, remoteEnabled: e.target.checked } as SettingsFormState))}
-                />
-                Enable remote access controls
-              </label>
-              <small>Configure provider settings, tunnel lifecycle, and tokenized remote URLs.</small>
-            </div>
-
             <div className="form-group">
               <label htmlFor="remoteActiveProvider">Active provider</label>
               <select

packages/dashboard/app/components/__tests__/SettingsModal.test.tsx

@@ -200,7 +200,6 @@ describe("SettingsModal", () => {
     mockFetchDashboardHealth.mockResolvedValue({ status: "ok", version: "1.2.3", uptime: 123 });
     mockFetchRemoteSettings.mockResolvedValue({
       settings: {
-        remoteEnabled: false,
         remoteActiveProvider: null,
         remoteTailscaleEnabled: false,
         remoteTailscaleHostname: "",
@@ -221,7 +220,6 @@ describe("SettingsModal", () => {
     });
     mockUpdateRemoteSettings.mockResolvedValue({
       settings: {
-        remoteEnabled: false,
         remoteActiveProvider: null,
         remoteTailscaleEnabled: false,
         remoteTailscaleHostname: "",

packages/dashboard/src/__tests__/remote-access-headless.test.ts

@@ -75,7 +75,6 @@ async function REQUEST(
 describe("remote access headless parity", () => {
   function buildRemoteAccessSettings() {
     return {
-      enabled: true,
       activeProvider: "cloudflare" as const,
       providers: {
         tailscale: {

packages/dashboard/src/__tests__/remote-access-routes.test.ts

@@ -8,7 +8,6 @@ import { request as performRequest } from "../test-request.js";
 
 function buildRemoteAccessSettings(overrides: Record<string, unknown> = {}) {
   return {
-    enabled: true,
     activeProvider: "cloudflare" as const,
     providers: {
       tailscale: {

packages/dashboard/src/__tests__/remote-auth.test.ts

@@ -14,7 +14,6 @@ import {
 
 function createRemoteSettings(overrides: Partial<RemoteAccessProjectSettings> = {}): RemoteAccessProjectSettings {
   return {
-    enabled: true,
     activeProvider: "tailscale",
     providers: {
       tailscale: {
@@ -94,7 +93,7 @@ describe("remote-auth", () => {
   });
 
   it("returns disabled when remote access or token strategy is disabled", () => {
-    const disabledRemote = validateRemoteAuthToken("anything", createRemoteSettings({ enabled: false }));
+    const disabledRemote = validateRemoteAuthToken("anything", createRemoteSettings({ activeProvider: null }));
     expect(disabledRemote).toEqual({ status: "disabled" });
 
     const disabledStrategies = validateRemoteAuthToken(

packages/dashboard/src/__tests__/routes-remote-access.test.ts

@@ -8,7 +8,6 @@ import { request as performRequest } from "../test-request.js";
 
 function buildRemoteAccessSettings() {
   return {
-    enabled: true,
     activeProvider: "cloudflare" as const,
     providers: {
       tailscale: {

packages/dashboard/src/__tests__/routes.test.ts

@@ -13670,7 +13670,6 @@ describe("GET /settings/scopes", () => {
       global: { themeMode: "dark" },
       project: {
         remoteAccess: {
-          enabled: true,
           activeProvider: "tailscale",
           providers: {
             tailscale: {

packages/dashboard/src/remote-auth.ts

@@ -110,12 +110,16 @@ function isRemoteAccessTokenStrategyEnabled(settings: RemoteAccessSettings): boo
   return settings.tokenStrategy.persistent.enabled || settings.tokenStrategy.shortLived.enabled;
 }
 
+function isRemoteProviderEnabled(settings: RemoteAccessSettings): boolean {
+  return Boolean(settings.activeProvider != null && settings.providers[settings.activeProvider]?.enabled);
+}
+
 export function validateRemoteAuthToken(
   rt: string | null | undefined,
   settings: RemoteAccessSettings,
   nowMs: number = Date.now(),
 ): RemoteTokenValidationResult {
-  if (!settings.enabled || !isRemoteAccessTokenStrategyEnabled(settings)) {
+  if (!isRemoteProviderEnabled(settings) || !isRemoteAccessTokenStrategyEnabled(settings)) {
     return { status: "disabled" };
   }
 

packages/dashboard/src/routes/register-settings-memory-routes.ts

@@ -122,8 +122,8 @@ export function registerSettingsMemoryRoutes(ctx: ApiRoutesContext, deps: Settin
     const settings = await scopedStore.getSettings();
     const remoteAccess = settings.remoteAccess;
 
-    if (!remoteAccess?.enabled) {
-      throw new ApiError(409, "Remote access is disabled", { code: "REMOTE_ACCESS_DISABLED" });
+    if (!remoteAccess || remoteAccess.activeProvider == null || !remoteAccess.providers[remoteAccess.activeProvider]?.enabled) {
+      throw new ApiError(409, "No remote provider is enabled", { code: "REMOTE_ACCESS_DISABLED" });
     }
 
     const baseUrl = resolveRemoteBaseUrl(remoteAccess);
@@ -266,7 +266,8 @@ export function registerSettingsMemoryRoutes(ctx: ApiRoutesContext, deps: Settin
   function toRemoteSettingsPayload(remoteAccess: NonNullable<Awaited<ReturnType<typeof store.getSettings>>["remoteAccess"]>) {
     const persistentToken = remoteAccess.tokenStrategy.persistent.token?.trim() ?? "";
     return {
-      remoteEnabled: Boolean(remoteAccess.enabled),
+      remoteEnabled: remoteAccess.activeProvider != null &&
+        (remoteAccess.providers[remoteAccess.activeProvider]?.enabled ?? false),
       remoteActiveProvider: remoteAccess.activeProvider ?? null,
       remoteTailscaleEnabled: Boolean(remoteAccess.providers.tailscale.enabled),
       remoteTailscaleHostname: remoteAccess.providers.tailscale.hostname,
@@ -315,7 +316,6 @@ export function registerSettingsMemoryRoutes(ctx: ApiRoutesContext, deps: Settin
       const body = (req.body ?? {}) as Record<string, unknown>;
       const nextRemoteAccess = {
         ...remoteAccess,
-        enabled: body.remoteEnabled === undefined ? remoteAccess.enabled : Boolean(body.remoteEnabled),
         activeProvider: body.remoteActiveProvider === undefined
           ? remoteAccess.activeProvider
           : (body.remoteActiveProvider as "tailscale" | "cloudflare" | null),