feat: secure React dashboard cutover

tests/config.test.ts

@@ -294,7 +294,7 @@ describe('ConfigSchema', () => {
 describe('loadConfig', () => {
   const originalCwd = process.cwd;
   const savedEnv: Record<string, string | undefined> = {};
-  const trackedEnvKeys = ['OPENROUTER_API_KEY', 'REDDIT_USERNAME', 'REDDIT_PASSWORD', 'BROWSER_HEADLESS'];
+  const trackedEnvKeys = ['OPENROUTER_API_KEY', 'REDDIT_USERNAME', 'REDDIT_PASSWORD', 'BROWSER_HEADLESS', 'WEB_DASHBOARD_TOKEN'];
 
   beforeEach(() => {
     // Snapshot then clear any env vars that loadConfig consults — these may be
@@ -303,6 +303,7 @@ describe('loadConfig', () => {
       savedEnv[key] = process.env[key];
       delete process.env[key];
     }
+    process.env.WEB_DASHBOARD_TOKEN = 'test-dashboard-token';
 
     const mockDir = '/tmp/test-config-' + Date.now();
     fs.mkdirSync(mockDir, { recursive: true });
@@ -411,4 +412,34 @@ openrouter:
 
 expect(() => loadConfig()).toThrow('OPENROUTER_API_KEY environment variable is required');
   });
+
+  it('requires a dashboard token when the dashboard is enabled', () => {
+    delete process.env.WEB_DASHBOARD_TOKEN;
+    const configPath = path.join(process.cwd(), 'config.yaml');
+    fs.writeFileSync(configPath, `
+reddit:
+  subreddits: [test]
+openrouter:
+  apiKey: key
+  imageAnalysisPrompt: analyze this
+  messageGenerationPrompt: write message
+`);
+
+    expect(() => loadConfig()).toThrow('WEB_DASHBOARD_TOKEN');
+  });
+
+  it('injects the dashboard token from the environment', () => {
+    process.env.WEB_DASHBOARD_TOKEN = 'a-secure-dashboard-token';
+    const configPath = path.join(process.cwd(), 'config.yaml');
+    fs.writeFileSync(configPath, `
+reddit:
+  subreddits: [test]
+openrouter:
+  apiKey: key
+  imageAnalysisPrompt: analyze this
+  messageGenerationPrompt: write message
+`);
+
+    expect(loadConfig().web.authToken).toBe('a-secure-dashboard-token');
+  });
 });