Auth + CORS + debug-surface isolation

[balegas]

Everything is currently unauthenticated: /v1/shape, the engine control plane (POST /shapes, /query, /schema), the debug endpoints (/graph, /trace, /memory), the tRPC API, and the DS server (anyone with a stream id can read shape data). No CORS on engine or API.

Decisions (aligned in discussion):

1. Shared deployment secret, two presentations: ?secret= on /v1/shape (Electric-parity — their client works unchanged; 401 on mismatch), Authorization: Bearer on the extended tRPC API. Explicit ELECTRIC_IVM_INSECURE=true opt-out validated at boot (refuse to start with neither secret nor flag). Secret redaction in logs/traces.
2. Debug surface moves to a separate utility port (like upstream's prometheus port): /graph, /trace, /memory, /metrics, /subqueries, shape sweep/management. Deployments simply don't expose it; pipeline-viz points at the utility bind. Main port keeps only /v1/shape, /health (+/ready), and the authed control plane.
3. DS server stays internal — not exposed to clients at all. The extended API proxies feed reads (streamUrl points at an API route, e.g. GET /feeds/<shapeId>?offset=…), authenticated with the bearer secret. The proxy must pass through the DS cache headers (cache-control, etag, stream-cursor, stream-next-offset, stream-up-to-date) so Extended API caching: serve shape feeds via the Rust DS server's built-in CDN protocol #11's CDN story survives the hop — the CDN fronts the API instead of the DS server. Signed per-stream URLs remain a possible later optimization to remove the hop.
4. CORS: on /v1/shape (echo Origin, expose the electric-* header set, preflight with access-control-max-age), and on the API feed-proxy route.

🤖 Generated with Claude Code