Security policy now configurable via environment variables

Instance administrators previously had to configure security policies manually through the UI or API after startup. For teams running n8n in containers or managing multiple deployments, this meant either repetitive manual work or custom tooling to apply consistent security settings across environments.

Security policy settings — MFA enforcement, personal space publishing, and personal space sharing — can now be controlled via environment variables. When N8N_SECURITY_POLICY_MANAGED_BY_ENV is set to true, these policies are applied automatically on every instance startup. The CLI loader retrieves the configuration values and updates the relevant services before the instance becomes operational.

When security settings are managed by environment variables, the API rejects any attempt to modify them through the UI or endpoints. The frontend displays a notice indicating that settings are controlled via environment variables and disables the relevant toggle controls. This prevents configuration drift between what the environment specifies and what users might set through the interface.

The implementation follows the same pattern already used for owner settings — a dedicated loader class applies configuration during the startup sequence, with a master toggle that serves as a gate for all related environment variables. In the CLI package, new environment variables were added to the configuration schema. The API controllers gained guards that prevent updates when the environment is managing settings, and the SecuritySettingsDto now exposes a managedByEnv flag so clients know the state. The frontend component uses this flag to present a read-only view when appropriate.