feat: secure React dashboard cutover

src/config/index.ts

@@ -151,7 +151,11 @@ export const ConfigSchema = z.object({
   web: z.object({
     enabled: z.boolean().default(true),
     port: z.number().default(3000),
-  }).default({ enabled: true, port: 3000 }),
+    /** Prefer WEB_DASHBOARD_TOKEN so secrets do not live in config.yaml. */
+    authToken: z.string().min(8).optional(),
+    /** Dangerous diagnostic endpoints are disabled unless explicitly enabled. */
+    debugEnabled: z.boolean().default(false),
+  }).default({ enabled: true, port: 3000, debugEnabled: false }),
 });
 
 export type Config = z.infer<typeof ConfigSchema>;
@@ -186,6 +190,11 @@ export function loadConfig(): Config {
     rawConfig.browser.headless = process.env.BROWSER_HEADLESS === 'true';
   }
 
+  if (process.env.WEB_DASHBOARD_TOKEN !== undefined) {
+    if (!rawConfig.web) rawConfig.web = {};
+    rawConfig.web.authToken = process.env.WEB_DASHBOARD_TOKEN;
+  }
+
   if (!rawConfig.openrouter.apiKey) {
     throw new Error('OPENROUTER_API_KEY environment variable is required');
   }
@@ -199,5 +208,9 @@ export function loadConfig(): Config {
     throw new Error(`Invalid configuration:\n${errors}`);
   }
 
+  if (result.data.web.enabled && !result.data.web.authToken) {
+    throw new Error('WEB_DASHBOARD_TOKEN environment variable or web.authToken configuration is required when the dashboard is enabled');
+  }
+
   return result.data;
 }