Auth + CORS + debug-surface isolation

Everything is currently unauthenticated: /v1/shape, the engine control plane (POST /shapes, /query, /schema), the debug endpoints (/graph, /trace, /memory), the tRPC API, and the DS server (anyone with a stream id can read shape data). No CORS on engine or API.

**Decisions (aligned in discussion):**

1. **Shared deployment secret**, two presentations: `?secret=` on `/v1/shape` (Electric-parity — their client works unchanged; 401 on mismatch), `Authorization: Bearer` on the extended tRPC API. Explicit `ELECTRIC_IVM_INSECURE=true` opt-out validated at boot (refuse to start with neither secret nor flag). Secret redaction in logs/traces.
2. **Debug surface moves to a separate utility port** (like upstream's prometheus port): `/graph`, `/trace`, `/memory`, `/metrics`, `/subqueries`, shape sweep/management. Deployments simply don't expose it; pipeline-viz points at the utility bind. Main port keeps only `/v1/shape`, `/health` (+`/ready`), and the authed control plane.
3. **DS server stays internal** — not exposed to clients at all. The extended API proxies feed reads (`streamUrl` points at an API route, e.g. `GET /feeds/?offset=…`), authenticated with the bearer secret. The proxy must pass through the DS cache headers (`cache-control`, `etag`, `stream-cursor`, `stream-next-offset`, `stream-up-to-date`) so #11's CDN story survives the hop — the CDN fronts the API instead of the DS server. Signed per-stream URLs remain a possible later optimization to remove the hop.
4. **CORS:** on `/v1/shape` (echo Origin, expose the `electric-*` header set, preflight with `access-control-max-age`), and on the API feed-proxy route.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Start by locating the handlers and server binds for `/v1/shape`, the control-plane routes, debug endpoints, tRPC API, and DS server. Compare their current exposure and authentication with the decisions in the issue; done means the main and utility surfaces are isolated as specified, feed reads are proxied with the listed cache headers, and the required CORS behavior is in place.

Written by the indexing model from the issue text.