ADR-003 wiring: Bearer token + IP allowlist middleware

Implements the auth posture from ADR-003 (commit 0d18ffa). Two
independent layers — Bearer token (constant-time compare via
crypto/subtle) and IP allowlist (CIDR set) — composed in shared.Run
so every binary inherits the same gate without per-binary wiring.

Together with the bind-gate from commit 6af0520, this mechanically
closes audit risks R-001 + R-007:
  - non-loopback bind without auth.token = startup refuse
  - non-loopback bind WITH auth.token + override env = allowed
  - loopback bind = all gates open (G0 dev unchanged)

internal/shared/auth.go (NEW)
  RequireAuth(cfg AuthConfig) returns chi-compatible middleware.
  Empty Token + empty AllowedIPs → pass-through (G0 dev mode).
  Token-only → 401 Bearer mismatch.
  AllowedIPs-only → 403 source IP not in CIDR set.
  Both → both gates apply.
  /health bypasses both layers (load-balancer / liveness probes
  shouldn't carry tokens).

  CIDR parsing pre-runs at boot; bare IP (no /N) treated as /32 (or
  /128 for IPv6). Invalid entries log warn and drop, fail-loud-but-
  not-fatal so a typo doesn't kill the binary.

  Token comparison: subtle.ConstantTimeCompare on the full
  "Bearer <token>" wire-format string. Length-mismatch returns 0
  (per stdlib spec), so wrong-length tokens reject without timing
  leak. Pre-encoded comparison slice stored in the middleware
  closure — one allocation per request.

  Source-IP extraction prefers net.SplitHostPort fallback to
  RemoteAddr-as-is for httptest compatibility. X-Forwarded-For
  support is a follow-up when a trusted proxy fronts the gateway
  (config knob TBD per ADR-003 §"Future").

internal/shared/server.go
  Run signature: gained AuthConfig parameter (4th arg).
  /health stays mounted on the outer router (public).
  Registered routes go inside chi.Group with RequireAuth applied —
  empty config = transparent group.
  Added requireAuthOnNonLoopback startup check: non-loopback bind
  with empty Token = refuse to start (cites R-001 + R-007 by name).

internal/shared/config.go
  AuthConfig type added with TOML tags. Fields: Token, AllowedIPs.
  Composed into Config under [auth].

cmd/<svc>/main.go × 7 (catalogd, embedd, gateway, ingestd, queryd,
storaged, vectord, mcpd is unaffected — stdio doesn't bind a port)
  Each call site adds cfg.Auth as the 4th arg to shared.Run. No
  other changes — middleware applies via shared.Run uniformly.

internal/shared/auth_test.go (12 test funcs)
  Empty config pass-through, missing-token 401, wrong-token 401,
  correct-token 200, raw-token-without-Bearer-prefix 401, /health
  always public, IP allowlist allow + reject, bare IP /32, both
  layers when both configured, invalid CIDR drop-with-warn, RemoteAddr
  shape extraction. The constant-time comparison is verified by
  inspection (comments in auth.go) plus the existence of the
  passthrough test (length-mismatch case).

Verified:
  go test -count=1 ./internal/shared/  — all green (was 21, now 33 funcs)
  just verify                            — vet + test + 9 smokes 33s
  just proof contract                    — 53/0/1 unchanged

Smokes + proof harness keep working without any token configuration:
default Auth is empty struct → middleware is no-op → existing tests
pass unchanged. To exercise the gate, operators set [auth].token in
lakehouse.toml (or, per the "future" note in the ADR, via env var).

Closes audit findings:
  R-001 HIGH — fully mechanically closed (was: partial via bind gate)
  R-007 MED  — fully mechanically closed (was: design-only ADR-003)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/shared/server.go

@@ -48,14 +48,28 @@ type RegisterRoutes func(r chi.Router)
 // (Per Kimi review #4: shared library functions shouldn't silently
 // mutate package globals.)
 //
-// Refuses to bind a non-loopback address unless the
-// LH_<SERVICE>_ALLOW_NONLOOPBACK=1 env is set — closes the accidental
-// 0.0.0.0 deploy path for R-001 (queryd /sql is RCE-equivalent off
-// loopback, but the gate applies to every binary uniformly).
-func Run(serviceName, addr string, register RegisterRoutes) error {
+// Three startup gates apply in order:
+//
+//  1. requireLoopbackOrOverride — refuses non-loopback bind unless
+//     LH_<SERVICE>_ALLOW_NONLOOPBACK=1 is set. Closes the accidental
+//     0.0.0.0 deploy path for R-001.
+//  2. requireAuthOnNonLoopback — refuses non-loopback bind when
+//     auth.token is empty. Mechanically prevents R-001 + R-007's
+//     worst case: world-reachable bind with no auth layer.
+//  3. RequireAuth middleware — runs per-request on registered routes.
+//     /health stays exempt (mounted on the outer router, before the
+//     authed group).
+//
+// Per ADR-003: empty auth.token + empty allowed_ips → middleware is
+// a no-op. Smokes and proof harness keep working without setting
+// either.
+func Run(serviceName, addr string, register RegisterRoutes, auth AuthConfig) error {
 	if err := requireLoopbackOrOverride(serviceName, addr); err != nil {
 		return err
 	}
+	if err := requireAuthOnNonLoopback(serviceName, addr, auth); err != nil {
+		return err
+	}
 
 	logger := slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{
 		Level: slog.LevelInfo,
@@ -67,6 +81,8 @@ func Run(serviceName, addr string, register RegisterRoutes) error {
 	r.Use(middleware.Recoverer)
 	r.Use(slogRequest(logger))
 
+	// /health stays on the outer router — public, no auth. Operators
+	// rely on it for liveness probes that don't carry a token.
 	r.Get("/health", func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		_ = json.NewEncoder(w).Encode(HealthResponse{
@@ -76,7 +92,13 @@ func Run(serviceName, addr string, register RegisterRoutes) error {
 	})
 
 	if register != nil {
-		register(r)
+		// Registered routes live inside an auth-gated group so
+		// RequireAuth applies uniformly without per-handler wiring.
+		// Empty auth → middleware is a no-op (group is transparent).
+		r.Group(func(authed chi.Router) {
+			authed.Use(RequireAuth(auth))
+			register(authed)
+		})
 	}
 
 	srv := &http.Server{