feat(security): hook-event auth secret + tunnel password guard

Two hardening fixes for the public-tunnel exposure path (COD-54 / COD-55).

COD-54 — gate the /api/hook-event localhost bypass when a tunnel is up:
`cloudflared --url http://127.0.0.1:port` proxies internet traffic INTO the
loopback origin, so a tunneled hook request arrives with req.ip === 127.0.0.1
and the old bare-localhost bypass would pass it unauthenticated. Now:
- tunnel running  → bypass requires a shared per-instance hook secret
  (X-Codeman-Hook-Secret header; constant-time compare) + per-IP rate limiting
- tunnel not running (loopback-only, the normal case) → unchanged, so
  already-deployed credential-less hooks keep working.
New src/config/hook-secret.ts; auth middleware takes a getTunnelRunning probe
(wired from server.ts via tunnelManager.isRunning()).

COD-55 — refuse starting the Cloudflare tunnel without auth:
enabling the tunnel publishes full terminal control to a public URL; with no
CODEMAN_PASSWORD the auth middleware is inactive and the bind guard never trips
(tunnel binds loopback). PUT /api/settings now refuses tunnelEnabled:true with a
403 (before persisting) unless CODEMAN_PASSWORD is set or
CODEMAN_ALLOW_UNAUTHENTICATED_NETWORK=1 is acknowledged. New
isUnauthenticatedNetworkAcknowledged() in network-auth-policy; settings-ui
surfaces the refusal as an error toast and reverts the toggle.

Scope: the always-on CSRF/Origin guard, Host-header allowlist, and
network-auth-policy itself are already upstream (#113) and not re-proposed here.

Verification: tsc, eslint, prettier, check:frontend-syntax clean; full test:ci
green (2723 passed), incl. test/cod54-hook-event-auth and
test/routes/system-routes-tunnel-guard.

test/routes/system-routes-tunnel-guard.test.ts

@@ -0,0 +1,133 @@
+/**
+ * @fileoverview COD-55 — tunnel password guard.
+ *
+ * Enabling the Cloudflare tunnel publishes the whole app (full terminal control =
+ * effectively RCE) to a public *.trycloudflare.com URL. When no CODEMAN_PASSWORD
+ * is set, requests through that URL are unauthenticated. These tests assert the
+ * PUT /api/settings tunnel-enable path REFUSES to start the tunnel unless a
+ * password is set OR the unauthenticated-network opt-in is acknowledged.
+ *
+ * Uses app.inject() — no real HTTP ports needed. Port: N/A.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { createRouteTestHarness, type RouteTestHarness } from './_route-test-utils.js';
+import { registerSystemRoutes } from '../../src/web/routes/system-routes.js';
+
+// Settings are written to disk via fs/promises — stub so the guard test never
+// touches the real settings.json, and so we can assert "not persisted on refusal".
+vi.mock('node:fs/promises', () => ({
+  default: {
+    readFile: vi.fn(async () => '{}'),
+    writeFile: vi.fn(async () => undefined),
+  },
+}));
+
+vi.mock('node:fs', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:fs')>();
+  return {
+    ...actual,
+    existsSync: vi.fn(() => true),
+    mkdirSync: vi.fn(),
+    readdirSync: vi.fn(() => []),
+  };
+});
+
+import fs from 'node:fs/promises';
+const mockedWriteFile = vi.mocked(fs.writeFile);
+
+/** Build a tunnelManager stub the route's ctx can use. */
+function makeTunnelManager(running = false) {
+  return {
+    start: vi.fn(),
+    stop: vi.fn(),
+    isRunning: vi.fn(() => running),
+    getUrl: vi.fn(() => null),
+    getStatus: vi.fn(() => ({ running })),
+  };
+}
+
+describe('COD-55 tunnel password guard (PUT /api/settings tunnelEnabled)', () => {
+  let harness: RouteTestHarness;
+  let tunnel: ReturnType<typeof makeTunnelManager>;
+  const savedPassword = process.env.CODEMAN_PASSWORD;
+  const savedOptIn = process.env.CODEMAN_ALLOW_UNAUTHENTICATED_NETWORK;
+
+  beforeEach(async () => {
+    harness = await createRouteTestHarness(registerSystemRoutes);
+    vi.clearAllMocks();
+    mockedWriteFile.mockResolvedValue(undefined);
+    tunnel = makeTunnelManager(false);
+    // tunnelManager is null in the default mock ctx — inject our spy.
+    (harness.ctx as unknown as { tunnelManager: unknown }).tunnelManager = tunnel;
+    delete process.env.CODEMAN_PASSWORD;
+    delete process.env.CODEMAN_ALLOW_UNAUTHENTICATED_NETWORK;
+  });
+
+  afterEach(async () => {
+    await harness.app.close();
+    if (savedPassword === undefined) delete process.env.CODEMAN_PASSWORD;
+    else process.env.CODEMAN_PASSWORD = savedPassword;
+    if (savedOptIn === undefined) delete process.env.CODEMAN_ALLOW_UNAUTHENTICATED_NETWORK;
+    else process.env.CODEMAN_ALLOW_UNAUTHENTICATED_NETWORK = savedOptIn;
+  });
+
+  it('REFUSES tunnel-enable with no password and no opt-in (4xx, start not called)', async () => {
+    const res = await harness.app.inject({
+      method: 'PUT',
+      url: '/api/settings',
+      payload: { tunnelEnabled: true },
+    });
+
+    expect(res.statusCode).toBeGreaterThanOrEqual(400);
+    expect(res.statusCode).toBeLessThan(500);
+    const body = JSON.parse(res.body);
+    expect(body.success).toBe(false);
+    // Message should tell the user how to fix it.
+    expect(body.error).toMatch(/CODEMAN_PASSWORD|CODEMAN_ALLOW_UNAUTHENTICATED_NETWORK/);
+    // The tunnel must NOT have been started.
+    expect(tunnel.start).not.toHaveBeenCalled();
+    // And tunnelEnabled:true must NOT have been persisted.
+    expect(mockedWriteFile).not.toHaveBeenCalled();
+  });
+
+  it('ALLOWS tunnel-enable when CODEMAN_PASSWORD is set (start called, 200)', async () => {
+    process.env.CODEMAN_PASSWORD = 'hunter2';
+
+    const res = await harness.app.inject({
+      method: 'PUT',
+      url: '/api/settings',
+      payload: { tunnelEnabled: true },
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(tunnel.start).toHaveBeenCalledTimes(1);
+  });
+
+  it('ALLOWS tunnel-enable with the unauthenticated-network opt-in acknowledged (start called, 200)', async () => {
+    process.env.CODEMAN_ALLOW_UNAUTHENTICATED_NETWORK = '1';
+
+    const res = await harness.app.inject({
+      method: 'PUT',
+      url: '/api/settings',
+      payload: { tunnelEnabled: true },
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(tunnel.start).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not guard tunnel-disable (tunnelEnabled:false always allowed)', async () => {
+    tunnel = makeTunnelManager(true);
+    (harness.ctx as unknown as { tunnelManager: unknown }).tunnelManager = tunnel;
+
+    const res = await harness.app.inject({
+      method: 'PUT',
+      url: '/api/settings',
+      payload: { tunnelEnabled: false },
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(tunnel.stop).toHaveBeenCalledTimes(1);
+  });
+});