API authentication is silently skipped when auth_token is not configured

Summary

When api.auth_token is not set in config.toml, the API authentication
middleware silently skips all authentication checks, leaving all management
endpoints fully open.

Code

src/api/server.rs — api_auth_middleware:

async fn api_auth_middleware(
    State(state): State<Arc<ApiState>>,
    request: Request,
    next: Next,
) -> Response {
    let Some(expected_token) = state.auth_token.as_deref() else {
        // auth_token not configured → skip auth entirely
        return next.run(request).await;
    };
    // ...
}

Impact

Any self-hosted deployment that does not explicitly configure auth_token
exposes all API endpoints without any access control, including:

• GET/POST /api/secrets — read and write all agent secrets
• GET /api/config/raw — read the full config (tokens, keys)
• POST /api/system/backup/export — full data export
• POST/DELETE /api/agents — create or delete agents

This is a significant risk for self-hosted users who may not realize that
omitting auth_token disables authentication rather than failing safely.

Suggested fix

Return an error instead of passing through when auth_token is absent:

let expected_token = match state.auth_token.as_deref() {
    Some(token) if !token.is_empty() => token,
    _ => {
        return (
            StatusCode::SERVICE_UNAVAILABLE,
            Json(json!({"error": "API authentication is not configured"})),
        )
        .into_response();
    }
};

Alternatively, generate a random token at first startup and print it to the
log, so the API is never open by default.

Environment

• Deployment: self-hosted (Docker / systemd)
• Discovered via: whitebox source analysis

Start in src/api/server.rs at api_auth_middleware and trace how the API state and authentication responses are handled. Verify the behavior for a missing or empty auth_token across the listed management endpoints; done means unauthenticated requests are rejected safely while configured-token authentication continues to work.