feat(install): collapse Caddy to TLS-only, drop PUBLIC_PATHS, add --no-tls (ADR-0001 Child B — refs #54)

[thinmintdev]

Wave 2 of ADR-0001 (refs #54, lands the breaking change Child A unblocked).

ADR: docs/adr/0001-collapse-edge-auth-into-fastapi.md. Parent issue: #54. Spec: #56.

Summary

• Demote Caddy to a dumb TLS terminator + reverse proxy. All auth (password + session cookies + Bearer tokens) lives in FastAPI, where Child A put it.
• Delete the PUBLIC_PATHS frozenset + require_token_unless_public dependency. Route publicness is now declared by NOT attaching an auth dep at include_router(...) time — no allowlist, no two-source drift class of bugs (Caddy basic_auth swallows PUBLIC_PATHS allowlist — first-run wizard unbootstrappable #28, PUBLIC_PATHS duplicated in Python + Caddyfile — needs single source of truth #51).
• Drop --auth=basic + admin-credential prompts from installer/install.sh. Add --no-tls which skips Caddy entirely and binds FastAPI on 0.0.0.0:8080 (right path for hosts behind an existing reverse proxy).
• Wire the wizard's password step. Real integration in ui/src/views/FirstRun.vue — probes /api/auth/status on mount, auto-skips when a password is already set, otherwise renders a "Set up password (optional)" step that POSTs to /api/auth/password (Child A's first-run public path).

Files touched, by concern

Concern	Files
Caddyfile reduction	packaging/caddy/Caddyfile.template (-89 / +24, 107 → 42 lines — the directive block itself is the 10-line ADR §1 form; remainder is doc header + commented-import seam)
PUBLIC_PATHS deletion + router rewiring	src/hal0/api/middleware/auth.py, src/hal0/api/__init__.py, src/hal0/api/routes/v1.py (split into public_router + router), src/hal0/api/routes/health.py (doc comment)
Installer flag surface	installer/install.sh (drop --auth=basic, add --no-tls, rename HAL0_HOSTNAME → HAL0_PUBLIC_HOST, auto-pick tls internal vs ACME based on hostname)
Wizard UI hook	ui/src/views/FirstRun.vue (new step 1 = password; picker/license/install/done renumber to 2/3/4/5; auto-skip when password_set)
Harness rows	tests/harness/installer-test.sh (drop auth-basic; add tls-default + no-tls), scripts/harness.sh (rename HAL0_HARNESS_AUTH → HAL0_HARNESS_TLS)
Tests	tests/api/test_no_public_paths.py (new, 15 tests), tests/api/test_auth_middleware.py (drop /api/install/curated-models from the protected-routes parametrize — wizard endpoint now public by design)

git grep PUBLIC_PATHS returns zero hits in src/ and packaging/. Remaining mentions live in docs/adr/0001-..., tests/harness/FINDINGS.md, and a couple of historical comments — Child C will sweep those.

Caddyfile LoC delta

packaging/caddy/Caddyfile.template: 107 → 42 lines (-65 net). The actual Caddy directives went from basicauth + @public path matcher + 3 handle blocks + handle_path /chat* (~70 effective lines) down to:

{$HAL0_PUBLIC_HOST:hal0.local} {
    tls {$HAL0_TLS_DIRECTIVE:internal}
    encode zstd gzip
    reverse_proxy 127.0.0.1:8080
}

Wizard UI: real or scaffolded?

Real integration. ui/src/views/FirstRun.vue got a new step 1 (password) inserted before the picker. It probes /api/auth/status on mount; if password_set is already true the step auto-skips to the picker. Submit calls the public-on-first-run POST /api/auth/password. Skip advances without setting one. Step renumber: picker 1→2, license 2→3, install 3→4, done 4→5. Build verified with vite build.

Test results

PYTHONPATH=<worktree>/src uv run --no-sync pytest tests/
869 passed, 3 skipped, 4 deselected in 31.85s

15 new tests in tests/api/test_no_public_paths.py all green. The auth + installer regression suite (211 tests across test_auth_* + test_password_auth + test_installer_routes) all green.

Out of scope — Child C lands these

Per the ADR's three-PR plan:

• installer/README.md, PLAN.md, tests/harness/FINDINGS.md doc sweeps
• Closing [HITL] Pick a basic_auth credential capture story #43 (credential capture by deletion) and PUBLIC_PATHS duplicated in Python + Caddyfile — needs single source of truth #51 (PUBLIC_PATHS drift)
• Reframing FINDINGS.md docs(release-manifest): document hal0-web releases hosting flow #10 (the original Caddy basic_auth swallows PUBLIC_PATHS allowlist — first-run wizard unbootstrappable #28 entry) as "fixed by architecture removal"

Do NOT close #54 on merge — Child C still needs to land.

CI heads-up

Hal0ai org Actions are billing-blocked; PR CI will fail in ~2s with no logs. Verified locally with the PYTHONPATH=<worktree>/src uv run --no-sync pytest invocation above. User will admin-merge.

🤖 Generated with Claude Code