ADR-006: auth posture for non-loopback deploy + token rotation impl

ADR-003 locked the auth substrate; ADR-006 ratifies the operator
playbook + adds two implementation pieces needed for Sprint 4
deployment: env-resolved tokens and dual-token rotation.

Six decisions locked in docs/DECISIONS.md:
- 6.1: Non-loopback bind requires auth.token (mechanical gate at
       shared.Run, already implemented; this ratifies it).
- 6.2: Token from env, not TOML. /etc/lakehouse/auth.env (mode 0600)
       loaded by systemd EnvironmentFile=. New TokenEnv field on
       AuthConfig defaults to "AUTH_TOKEN".
- 6.3: AllowedIPs for inter-service same-trust-domain; Token for
       cross-trust-boundary (gateway ↔ external).
- 6.4: /health stays unauthenticated; everything else under
       shared.Run is gated. Already implemented; ratified here.
- 6.5: Token rotation is dual-token. New SecondaryTokens []string
       on AuthConfig — both primary and any secondary pass auth
       during the rotation window. Implemented in this commit.
- 6.6: TLS terminates at the network edge (nginx/Caddy), not
       in-process. Daemons stay HTTP-only; internal traffic stays
       on private subnets per Decision 6.3.

Implementation:
- internal/shared/config.go: AuthConfig gains TokenEnv +
  SecondaryTokens fields. New resolveAuthFromEnv() called by
  LoadConfig fills Token from os.Getenv(TokenEnv) when Token is
  empty. TokenEnv defaults to "AUTH_TOKEN" so the happy path needs
  no TOML config.
- internal/shared/auth.go: RequireAuth pre-encodes Bearer headers
  for primary + every secondary token; per-request constant-time
  compare walks the slice. Fast path is 1 compare (primary).

Tests:
- TestLoadConfig_AuthTokenFromEnv (3 sub-tests): default env name,
  custom token_env, explicit Token wins over env.
- TestRequireAuth_SecondaryTokenAccepted: both primary + secondary
  tokens pass during rotation window.
- TestRequireAuth_SecondaryTokensOnly: only-secondary path works
  for the case where primary was just promoted-to-empty mid-rotation.

go test ./internal/shared all green; existing auth_test.go
unchanged (constant-time compare path preserved).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/shared/auth_test.go

@@ -189,6 +189,49 @@ func TestRequireAuth_InvalidCIDR_LoggedAndDropped(t *testing.T) {
 	}
 }
 
+// TestRequireAuth_SecondaryTokenAccepted locks ADR-006 Decision 6.5:
+// during a token rotation, both primary and secondary token strings
+// pass auth. After every caller updates, operators promote secondary
+// → primary and clear secondary, completing the rotation.
+func TestRequireAuth_SecondaryTokenAccepted(t *testing.T) {
+	cfg := AuthConfig{
+		Token:           "primary-tok",
+		SecondaryTokens: []string{"secondary-tok"},
+	}
+	srv := httptest.NewServer(mountWithAuth(cfg))
+	defer srv.Close()
+
+	if status, _ := get(t, srv, "/data", "Bearer primary-tok"); status != http.StatusOK {
+		t.Errorf("primary token should pass, got %d", status)
+	}
+	if status, _ := get(t, srv, "/data", "Bearer secondary-tok"); status != http.StatusOK {
+		t.Errorf("secondary token should pass during rotation, got %d", status)
+	}
+	if status, _ := get(t, srv, "/data", "Bearer wrong-tok"); status != http.StatusUnauthorized {
+		t.Errorf("invalid token should still 401, got %d", status)
+	}
+}
+
+// TestRequireAuth_SecondaryTokensOnly locks the case where primary
+// is empty but secondaries are set — useful mid-rotation when the
+// previous primary was just promoted to nothing and the new primary
+// hasn't been written yet. As long as ANY token is configured, auth
+// is enforced.
+func TestRequireAuth_SecondaryTokensOnly(t *testing.T) {
+	cfg := AuthConfig{
+		SecondaryTokens: []string{"only-tok"},
+	}
+	srv := httptest.NewServer(mountWithAuth(cfg))
+	defer srv.Close()
+
+	if status, _ := get(t, srv, "/data", "Bearer only-tok"); status != http.StatusOK {
+		t.Errorf("only-secondary should pass, got %d", status)
+	}
+	if status, _ := get(t, srv, "/data", ""); status != http.StatusUnauthorized {
+		t.Errorf("missing token should 401, got %d", status)
+	}
+}
+
 func TestRemoteIP_SplitHostPortShape(t *testing.T) {
 	// Sanity: real httptest requests come through with "ip:port"
 	// shape; ensure remoteIP returns the IP portion.