server: authorize voice http bind

[yisding]

Problem

VoiceServer's retained aiohttp listener relied on a guard earlier in the larger startup transaction. That separation allowed a later refactor to move TCPSite construction away from the validation that authorizes it.

Change

• retain the existing early process-level bind guard and its exception ordering
• route TCPSite construction and start() through the shared authorized_bind capability
• preserve partial-site ownership, rollback ordering, and exact backend exceptions
• add lifecycle proofs that rejected authorization cannot construct the site and backend failures clean up the partial listener unchanged
• reclassify only the VoiceServer HTTP site in the bind inventory (5 authorized, 4 pending)

Test evidence

• env UV_FROZEN=1 uv run pytest tests/server/test_voice_server_lifecycle.py tests/server/test_auth.py tests/ratchets/test_bind_inventory.py -q — 70 passed, 4 skipped
• env UV_FROZEN=1 uv run pytest tests/config/test_secret_reprs.py tests/server/test_auth.py tests/transports/test_webrtc_auth_browser_playground.py -q — 74 passed, 3 skipped
• env UV_FROZEN=1 just check — pre-commit and mypy passed; 8,609 passed, 309 skipped

Stacked on #949.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 59504326-d3eb-4ff1-897e-d6a7c529a357

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}