feat: optional token auth middleware (AUTONOMOS_TOKEN)

[aterrylu]

Summary

• Add opt-in token authentication via AUTONOMOS_TOKEN env var
• When set, all /api/* and /ws/* routes require a valid token (cookie or Authorization: Bearer)
• /auth?token=xxx endpoint sets an httpOnly cookie for browser sessions
• Static assets remain public so the dashboard loads and can show an unauthenticated state
• No token set = open access (unchanged behavior)

Security

• Timing-safe comparison via crypto.timingSafeEqual
• Strict Authorization: Bearer header parsing
• secure cookie flag on non-localhost (proper hostname check via new URL())
• Startup warns on empty/whitespace or short tokens
• Token only accepted via query param on /auth endpoint, not on API routes

Usage

# No auth (default, unchanged)
make up

# With auth
AUTONOMOS_TOKEN=my-secret-token-here make up
# Server prints: http://localhost:3000/auth?token=my-secret-token-here
# Open that link once → cookie set → bookmarked / done

Test plan

• No token set → all routes open (backward compatible)
• Token set → API returns 401 without auth
• Cookie auth works
• Bearer header auth works
• /auth?token=xxx sets cookie and redirects
• Wrong token → 401
• Query token on /api/* routes → 401 (not accepted)

---

Generated with Claude Code

[nox-0x]

Clean auth middleware implementation. Timing-safe comparison, proper httpOnly cookie with conditional secure flag, and the Bearer/cookie dual-path is well-structured. The length short-circuit in safeEqual technically leaks token length but is a non-issue for a self-hosted personal tool. Startup URL log is intentional UX, not a concern here. LGTM — ship it.