#689 serve-auth: hard refusals for off-loopback without TLS or auth

Parent

Sub-issue of #662 (serve authentication & authorization). Layer 6.

Dependencies

• ✅ #675 — Static TLS
• ✅ #682 — Auth config schema
• ✅ #685 — `mode: token` authentication

Summary

Replace the existing `logger.warn` for off-loopback binding with hard startup refusals. An unauthenticated, unencrypted control plane reachable from the network is arbitrary remote execution — a warning nobody reads is not a security control.

The server refuses to start when:

• Bind address is non-loopback AND TLS is not enabled (`--cert-file`/`--key-file` not provided)
• Bind address is non-loopback AND `--auth-mode` is `none`

Loopback binds (`127.0.0.1`, `localhost`) continue to work with no TLS and no auth — that's the single-host development model.

What to build

Replace the existing warning in `src/cli/commands/serve.ts` (currently only fires when `mode: none`) with hard errors:

```typescript if (host !== "127.0.0.1" && host !== "localhost") { if (!tlsEnabled) { throw new Error( "Off-loopback binding requires TLS — provide --cert-file and --key-file, or bind to 127.0.0.1" ); } if (authConfig.mode === "none") { throw new Error( "Off-loopback binding requires authentication — set --auth-mode token or --auth-mode oauth, or bind to 127.0.0.1" ); } } ```

No `--force` override. These are non-negotiable.

Scope

• Replace warning with hard errors in `src/cli/commands/serve.ts`
• Remove the existing `logger.warn` for non-loopback binding
• Tests: off-loopback without TLS refuses, off-loopback without auth refuses, off-loopback with both TLS + auth starts, loopback with no TLS + no auth starts

References

• Existing warning: `src/cli/commands/serve.ts` (the `host !== "127.0.0.1" && host !== "localhost" && authConfig.mode === "none"` check)
• TLS flags: `--cert-file`, `--key-file` (#675)
• Auth config: `--auth-mode` (#682)