🦊🔥 Chonky GitRitual: Admin Token System & Auth Hardening

[AdaInTheLab]

This PR marks the completion of a full security foundation pass across admin auth, API tokens, and test infrastructure.

What started as “just add tokens” evolved (correctly) into a deeper systems ritual: tightening contracts, removing ambiguity, and making the backend boring in the best possible way.

---

✨ What This PR Does

🔐 Admin Token System

• Introduces secure API token minting and revocation
• Raw tokens are returned once and never stored
• Tokens are hashed with a pepper (fail-closed in production)
• Token listing never leaks secrets
• Revocation is idempotent and explicit

🛡️ Admin Auth Hardening

• Clarifies requireAdmin behavior (401 vs 403, bypass rules)
• Ensures deterministic failure modes
• Aligns middleware behavior with route expectations

🧪 Test Infrastructure & Coverage

• Adds Jest coverage for:
  • token minting / verification
  • admin token routes
  • auth middleware behavior
• Aligns tests with real API response shapes ({ ok, data })
• Prevents future regressions around auth + security flows
• Ignores generated coverage artifacts (coverage/)

🧱 API Contract Stabilization

• Normalizes status codes:
  • POST /admin/tokens → creates a resource
  • GET /admin/tokens → lists existing resources
  • POST /admin/tokens/:id/revoke → mutates existing state
• Removes ambiguity between implementation and tests

---

🧠 Why This Matters

This PR establishes a stable, test-backed security layer that future work can safely build on:

• CLI access
• Agent workflows
• Scoped permissions
• Automation & CI integrations

No haunted state.
No vibes-based auth.
No “why did this work yesterday?” energy.

---

🦝 Ritual Notes

• This was intentionally done as one cohesive change
• The system is now boring, predictable, and extensible
• Future work should build on top of this, not around it

---

Ritual complete. Chonk honored.

co-authored-by: Lyric lyric@thehumanpatternlab.com
co-authored-by: Carmel carmel@thehumanpatternlab.com