ADR-006: auth posture for non-loopback deploy + token rotation impl

ADR-003 locked the auth substrate; ADR-006 ratifies the operator
playbook + adds two implementation pieces needed for Sprint 4
deployment: env-resolved tokens and dual-token rotation.

Six decisions locked in docs/DECISIONS.md:
- 6.1: Non-loopback bind requires auth.token (mechanical gate at
       shared.Run, already implemented; this ratifies it).
- 6.2: Token from env, not TOML. /etc/lakehouse/auth.env (mode 0600)
       loaded by systemd EnvironmentFile=. New TokenEnv field on
       AuthConfig defaults to "AUTH_TOKEN".
- 6.3: AllowedIPs for inter-service same-trust-domain; Token for
       cross-trust-boundary (gateway ↔ external).
- 6.4: /health stays unauthenticated; everything else under
       shared.Run is gated. Already implemented; ratified here.
- 6.5: Token rotation is dual-token. New SecondaryTokens []string
       on AuthConfig — both primary and any secondary pass auth
       during the rotation window. Implemented in this commit.
- 6.6: TLS terminates at the network edge (nginx/Caddy), not
       in-process. Daemons stay HTTP-only; internal traffic stays
       on private subnets per Decision 6.3.

Implementation:
- internal/shared/config.go: AuthConfig gains TokenEnv +
  SecondaryTokens fields. New resolveAuthFromEnv() called by
  LoadConfig fills Token from os.Getenv(TokenEnv) when Token is
  empty. TokenEnv defaults to "AUTH_TOKEN" so the happy path needs
  no TOML config.
- internal/shared/auth.go: RequireAuth pre-encodes Bearer headers
  for primary + every secondary token; per-request constant-time
  compare walks the slice. Fast path is 1 compare (primary).

Tests:
- TestLoadConfig_AuthTokenFromEnv (3 sub-tests): default env name,
  custom token_env, explicit Token wins over env.
- TestRequireAuth_SecondaryTokenAccepted: both primary + secondary
  tokens pass during rotation window.
- TestRequireAuth_SecondaryTokensOnly: only-secondary path works
  for the case where primary was just promoted-to-empty mid-rotation.

go test ./internal/shared all green; existing auth_test.go
unchanged (constant-time compare path preserved).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/shared/config.go

@@ -298,6 +298,17 @@ func (m ModelsConfig) IsWeak(model string) bool {
 type AuthConfig struct {
 	Token      string   `toml:"token"`
 	AllowedIPs []string `toml:"allowed_ips"`
+	// TokenEnv names an environment variable; LoadConfig populates
+	// Token from os.Getenv(TokenEnv) when Token is empty. Per ADR-006
+	// 6.2: production deploys put the secret in /etc/lakehouse/auth.env
+	// (mode 0600) loaded by systemd EnvironmentFile=, NOT in the
+	// committed TOML. TokenEnv defaults to "AUTH_TOKEN".
+	TokenEnv string `toml:"token_env"`
+	// SecondaryTokens lets operators stage a rotation: both primary
+	// and any secondary token pass auth during the rotation window.
+	// After every caller updates, operators promote secondary →
+	// primary and clear secondary. Per ADR-006 Decision 6.5.
+	SecondaryTokens []string `toml:"secondary_tokens"`
 }
 
 // DefaultConfig returns the G0 dev defaults. Ports are shifted to
@@ -434,5 +445,25 @@ func LoadConfig(path string) (Config, error) {
 	if err := toml.Unmarshal(b, &cfg); err != nil {
 		return cfg, fmt.Errorf("parse config: %w", err)
 	}
+	resolveAuthFromEnv(&cfg.Auth)
 	return cfg, nil
 }
+
+// resolveAuthFromEnv populates cfg.Auth.Token from os.Getenv(TokenEnv)
+// when Token is empty. Per ADR-006 Decision 6.2: production deploys
+// keep the secret in /etc/lakehouse/auth.env (mode 0600), loaded by
+// systemd EnvironmentFile=, never in the committed TOML.
+//
+// TokenEnv defaults to "AUTH_TOKEN" so operators don't have to
+// configure both — setting AUTH_TOKEN env is enough.
+func resolveAuthFromEnv(auth *AuthConfig) {
+	envName := auth.TokenEnv
+	if envName == "" {
+		envName = "AUTH_TOKEN"
+	}
+	if auth.Token == "" {
+		if v := os.Getenv(envName); v != "" {
+			auth.Token = v
+		}
+	}
+}