ADR-006: auth posture for non-loopback deploy + token rotation impl

ADR-003 locked the auth substrate; ADR-006 ratifies the operator
playbook + adds two implementation pieces needed for Sprint 4
deployment: env-resolved tokens and dual-token rotation.

Six decisions locked in docs/DECISIONS.md:
- 6.1: Non-loopback bind requires auth.token (mechanical gate at
       shared.Run, already implemented; this ratifies it).
- 6.2: Token from env, not TOML. /etc/lakehouse/auth.env (mode 0600)
       loaded by systemd EnvironmentFile=. New TokenEnv field on
       AuthConfig defaults to "AUTH_TOKEN".
- 6.3: AllowedIPs for inter-service same-trust-domain; Token for
       cross-trust-boundary (gateway ↔ external).
- 6.4: /health stays unauthenticated; everything else under
       shared.Run is gated. Already implemented; ratified here.
- 6.5: Token rotation is dual-token. New SecondaryTokens []string
       on AuthConfig — both primary and any secondary pass auth
       during the rotation window. Implemented in this commit.
- 6.6: TLS terminates at the network edge (nginx/Caddy), not
       in-process. Daemons stay HTTP-only; internal traffic stays
       on private subnets per Decision 6.3.

Implementation:
- internal/shared/config.go: AuthConfig gains TokenEnv +
  SecondaryTokens fields. New resolveAuthFromEnv() called by
  LoadConfig fills Token from os.Getenv(TokenEnv) when Token is
  empty. TokenEnv defaults to "AUTH_TOKEN" so the happy path needs
  no TOML config.
- internal/shared/auth.go: RequireAuth pre-encodes Bearer headers
  for primary + every secondary token; per-request constant-time
  compare walks the slice. Fast path is 1 compare (primary).

Tests:
- TestLoadConfig_AuthTokenFromEnv (3 sub-tests): default env name,
  custom token_env, explicit Token wins over env.
- TestRequireAuth_SecondaryTokenAccepted: both primary + secondary
  tokens pass during rotation window.
- TestRequireAuth_SecondaryTokensOnly: only-secondary path works
  for the case where primary was just promoted-to-empty mid-rotation.

go test ./internal/shared all green; existing auth_test.go
unchanged (constant-time compare path preserved).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/shared/config_test.go

@@ -188,6 +188,71 @@ weak_models = ["custom-judge:latest", "qwen3:latest"]
 	}
 }
 
+// TestLoadConfig_AuthTokenFromEnv locks ADR-006 Decision 6.2:
+// production deploys put the secret in /etc/lakehouse/auth.env (mode
+// 0600), loaded by systemd EnvironmentFile=, NEVER in the committed
+// TOML. The TOML names the env var via token_env; the loader fills
+// Token from os.Getenv. TokenEnv defaults to "AUTH_TOKEN" so the
+// happy path needs no TOML config at all.
+func TestLoadConfig_AuthTokenFromEnv(t *testing.T) {
+	t.Run("default env name AUTH_TOKEN", func(t *testing.T) {
+		t.Setenv("AUTH_TOKEN", "from-default-env")
+		dir := t.TempDir()
+		path := filepath.Join(dir, "lakehouse.toml")
+		if err := os.WriteFile(path, []byte(`[auth]
+allowed_ips = []
+`), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		cfg, err := LoadConfig(path)
+		if err != nil {
+			t.Fatalf("LoadConfig: %v", err)
+		}
+		if cfg.Auth.Token != "from-default-env" {
+			t.Errorf("Token = %q, want from AUTH_TOKEN env", cfg.Auth.Token)
+		}
+	})
+
+	t.Run("custom env name from token_env", func(t *testing.T) {
+		t.Setenv("CUSTOM_AUTH_TOKEN", "from-custom-env")
+		dir := t.TempDir()
+		path := filepath.Join(dir, "lakehouse.toml")
+		if err := os.WriteFile(path, []byte(`[auth]
+token_env = "CUSTOM_AUTH_TOKEN"
+`), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		cfg, err := LoadConfig(path)
+		if err != nil {
+			t.Fatalf("LoadConfig: %v", err)
+		}
+		if cfg.Auth.Token != "from-custom-env" {
+			t.Errorf("Token = %q, want from CUSTOM_AUTH_TOKEN env", cfg.Auth.Token)
+		}
+	})
+
+	t.Run("explicit token wins over env", func(t *testing.T) {
+		t.Setenv("AUTH_TOKEN", "from-env")
+		dir := t.TempDir()
+		path := filepath.Join(dir, "lakehouse.toml")
+		if err := os.WriteFile(path, []byte(`[auth]
+token = "from-toml"
+`), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		cfg, err := LoadConfig(path)
+		if err != nil {
+			t.Fatalf("LoadConfig: %v", err)
+		}
+		// Explicit Token in TOML wins over env — the loader only
+		// fills from env when Token is empty. Lets local dev
+		// override prod env vars.
+		if cfg.Auth.Token != "from-toml" {
+			t.Errorf("Token = %q, want explicit TOML value", cfg.Auth.Token)
+		}
+	})
+}
+
 func TestLoadConfig_InvalidTOML_ReturnsError(t *testing.T) {
 	dir := t.TempDir()
 	cfgPath := filepath.Join(dir, "bad.toml")