Add bearer token API authentication

- Auto-generate random 32-char bearer token on first startup, stored in
  secrets.yaml as api.bearerToken
- BearerAuthMiddleware checks Authorization: Bearer <token> on all /api/
  endpoints except /health, /health/reconcile, /events (SSE), and non-API
  paths (frontend static files)
- Development mode (WILD_CENTRAL_ENV=development) skips auth entirely
- Web app ApiClient: add setToken/clearToken/hasToken methods, persist
  token in localStorage, automatically include Authorization header on
  all API requests
- Token can be found in secrets.yaml for CLI/automation use

internal/api/v1/handlers.go

@@ -256,10 +256,16 @@ func (api *API) StartConvergenceLoop(ctx gocontext.Context, interval time.Durati
 	slog.Info("convergence loop started", "component", "reconcile", "interval", interval)
 }
 
-func (api *API) RegisterRoutes(r *mux.Router) {
+func (api *API) RegisterRoutes(r *mux.Router, bearerToken string, devMode bool) {
 	r.Use(RequestLoggingMiddleware)
 
-	// Health
+	// Bearer token authentication — protects all /api/ routes.
+	// Dev mode skips auth for ease of development.
+	if !devMode && bearerToken != "" {
+		r.Use(BearerAuthMiddleware(bearerToken))
+	}
+
+	// Health (accessible even with auth — middleware exempts /health)
 	r.HandleFunc("/api/v1/health/reconcile", api.ReconcileHealth).Methods("GET")
 
 	// Resource-oriented settings (persisted in state.yaml)

internal/api/v1/middleware.go

@@ -37,6 +37,43 @@ func (w *statusResponseWriter) Flush() {
 	}
 }
 
+// BearerAuthMiddleware returns middleware that requires a valid Bearer token
+// on all API endpoints except health checks and the SSE event stream.
+func BearerAuthMiddleware(token string) mux.MiddlewareFunc {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			path := r.URL.Path
+
+			// Public endpoints — no auth required
+			if path == "/api/v1/health" || path == "/api/v1/health/reconcile" ||
+				strings.HasSuffix(path, "/events") {
+				next.ServeHTTP(w, r)
+				return
+			}
+
+			// Non-API paths (frontend static files) — no auth required
+			if !strings.HasPrefix(path, "/api/") {
+				next.ServeHTTP(w, r)
+				return
+			}
+
+			auth := r.Header.Get("Authorization")
+			if auth == "" {
+				http.Error(w, `{"error":"authentication required"}`, http.StatusUnauthorized)
+				return
+			}
+
+			const prefix = "Bearer "
+			if !strings.HasPrefix(auth, prefix) || auth[len(prefix):] != token {
+				http.Error(w, `{"error":"invalid token"}`, http.StatusUnauthorized)
+				return
+			}
+
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
 // RequestLoggingMiddleware logs method, path, status, and duration for each request.
 // Long-lived connections (SSE, WebSocket) are excluded.
 func RequestLoggingMiddleware(next http.Handler) http.Handler {