fix(server): safe-by-default HTTP boundary + tests (CRITICAL)

[willgitdata]

Summary

Address the critical server-defaults finding from the code review. Before this patch, a fresh npx augur-server or docker compose up exposed destructive admin endpoints to whoever could reach the port. After: doing nothing yields a safe state, and only explicit choices open the door.

What changed

Library (buildServer)

• cors defaults to false (was true = reflect any origin).
• /admin/* and DELETE /traces return 503 until apiKey is configured. They never run unauthenticated, even on loopback.
• When apiKey is set, every non-public endpoint requires x-api-key (admin included). Auth rejection uses return reply for clarity.

CLI (augur-server)

• HOST defaults to 127.0.0.1 (was 0.0.0.0). Bind LAN-wide only by explicit opt-in.
• New AUGUR_CORS env var: comma-separated allowlist or *.
• Loud startup warnings for non-loopback-without-key and CORS-reflect-all.

Docker

• docker-compose.yml publishes the host port to 127.0.0.1:3001 only.
• HOST=0.0.0.0 inside the container (correct for a single-process container; the published-port restriction limits exposure).
• Placeholder AUGUR_API_KEY commented in for easy enable.

Tests — packages/server/src/server.test.ts, 22 new tests, the first tests this package has ever had:

• Public routes reachable without auth (even when key is set).
• All non-public routes require the key when configured.
• /admin/* + DELETE /traces → 503 when key unset.
• /admin/* + DELETE /traces → 401 when key set but missing/wrong header.
• Query-string variants don't bypass the destructive check.
• CORS default false; explicit origin allowed; other origins rejected.
• Input validation (400) covered.

Test plan

• pnpm build → clean
• pnpm typecheck → clean
• pnpm test → 192 core + 22 server, all passing
• Manual: npx augur-server → server listens on 127.0.0.1:3001, /admin/clear returns 503.
• Manual: AUGUR_API_KEY=k npx augur-server → /admin/clear returns 401 without header, 200 with x-api-key: k.
• Manual: HOST=0.0.0.0 npx augur-server (no key) → loud warning logged.

Notes

• This is CRITICAL issue Post-rename cleanup from doc audit (4 fixes, 10 files, ±21) #1 from the code review.
• Backwards-compatible for users who set AUGUR_API_KEY and an explicit HOST. Users who relied on the implicit HOST=0.0.0.0 need to set HOST=0.0.0.0 (now an explicit choice).
• CORS default change is a minor breaking change. Documented in the README's new "Security defaults" section.

🤖 Generated with Claude Code