ADR-006: auth posture for non-loopback deploy + token rotation impl

ADR-003 locked the auth substrate; ADR-006 ratifies the operator
playbook + adds two implementation pieces needed for Sprint 4
deployment: env-resolved tokens and dual-token rotation.

Six decisions locked in docs/DECISIONS.md:
- 6.1: Non-loopback bind requires auth.token (mechanical gate at
       shared.Run, already implemented; this ratifies it).
- 6.2: Token from env, not TOML. /etc/lakehouse/auth.env (mode 0600)
       loaded by systemd EnvironmentFile=. New TokenEnv field on
       AuthConfig defaults to "AUTH_TOKEN".
- 6.3: AllowedIPs for inter-service same-trust-domain; Token for
       cross-trust-boundary (gateway ↔ external).
- 6.4: /health stays unauthenticated; everything else under
       shared.Run is gated. Already implemented; ratified here.
- 6.5: Token rotation is dual-token. New SecondaryTokens []string
       on AuthConfig — both primary and any secondary pass auth
       during the rotation window. Implemented in this commit.
- 6.6: TLS terminates at the network edge (nginx/Caddy), not
       in-process. Daemons stay HTTP-only; internal traffic stays
       on private subnets per Decision 6.3.

Implementation:
- internal/shared/config.go: AuthConfig gains TokenEnv +
  SecondaryTokens fields. New resolveAuthFromEnv() called by
  LoadConfig fills Token from os.Getenv(TokenEnv) when Token is
  empty. TokenEnv defaults to "AUTH_TOKEN" so the happy path needs
  no TOML config.
- internal/shared/auth.go: RequireAuth pre-encodes Bearer headers
  for primary + every secondary token; per-request constant-time
  compare walks the slice. Fast path is 1 compare (primary).

Tests:
- TestLoadConfig_AuthTokenFromEnv (3 sub-tests): default env name,
  custom token_env, explicit Token wins over env.
- TestRequireAuth_SecondaryTokenAccepted: both primary + secondary
  tokens pass during rotation window.
- TestRequireAuth_SecondaryTokensOnly: only-secondary path works
  for the case where primary was just promoted-to-empty mid-rotation.

go test ./internal/shared all green; existing auth_test.go
unchanged (constant-time compare path preserved).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/shared/auth.go

@@ -30,7 +30,7 @@ import (
 // RequireAuth returns a chi-compatible middleware that enforces
 // the configured AuthConfig. Empty config returns a pass-through.
 func RequireAuth(cfg AuthConfig) func(http.Handler) http.Handler {
-	tokenSet := cfg.Token != ""
+	tokenSet := cfg.Token != "" || len(cfg.SecondaryTokens) > 0
 	if !tokenSet && len(cfg.AllowedIPs) == 0 {
 		// G0 dev mode — no auth wired.
 		return passthrough
@@ -59,9 +59,20 @@ func RequireAuth(cfg AuthConfig) func(http.Handler) http.Handler {
 		allowedNets = append(allowedNets, n)
 	}
 
-	// Pre-encode the wire-format Bearer token so per-request
-	// comparison is one allocation against a precomputed slice.
-	expectedHeader := []byte("Bearer " + cfg.Token)
+	// Pre-encode wire-format Bearer headers for primary + every
+	// secondary token. Per-request comparison walks the slice with
+	// constant-time compare on each — fast path is the primary
+	// (first), so the typical case is one compare.
+	var expectedHeaders [][]byte
+	if cfg.Token != "" {
+		expectedHeaders = append(expectedHeaders, []byte("Bearer "+cfg.Token))
+	}
+	for _, sec := range cfg.SecondaryTokens {
+		if sec == "" {
+			continue
+		}
+		expectedHeaders = append(expectedHeaders, []byte("Bearer "+sec))
+	}
 
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -79,10 +90,14 @@ func RequireAuth(cfg AuthConfig) func(http.Handler) http.Handler {
 
 			if tokenSet {
 				got := []byte(r.Header.Get("Authorization"))
-				// ConstantTimeCompare returns 0 if lengths differ,
-				// 1 on match. Anything else (would be 0 or 1) is
-				// treated as no-match.
-				if subtle.ConstantTimeCompare(got, expectedHeader) != 1 {
+				matched := false
+				for _, want := range expectedHeaders {
+					if subtle.ConstantTimeCompare(got, want) == 1 {
+						matched = true
+						break
+					}
+				}
+				if !matched {
 					http.Error(w, "unauthorized", http.StatusUnauthorized)
 					return
 				}