feat(auth): M1 multi-tenant auth foundation (#81)

[viktor-shcherb]

Summary

Replaces the single shared MURMUR_TOKEN with a per-publisher namespace and
four-token model. Existing demo deploy continues to work via env-grandfathered
MURMUR_TOKEN.

• Publisher namespace (publishers, publisher_tokens,
  publisher_secrets, publisher_audit_events); pipelines scoped by
  publisher_id FK with back-fill default to the demo seed.
• Four-token model: admin, runner, webhook_signing,
  subcommand_bearer. admin/runner stored as SHA-256 hash; the two
  outgoing-use secrets stored plaintext (Murmur needs the cleartext to
  sign / inject).
• Auth zoning — bootstrapAuth(MURMUR_BOOTSTRAP_TOKEN) on
  POST /publishers; publisherAuth(db) on /pipelines*, /runs*,
  /publishers/me*; bearerAuth(MURMUR_TOKEN) retained on /work*
  and /mcp* (agent plane unchanged in M1).
• Cross-publisher isolation — UPSERT on pipelines scoped via
  ON CONFLICT WHERE publisher_id; runs reads JOIN through
  pipelines.publisher_id; cross-publisher reads return 404 (no
  information leak).
• Per-publisher webhook bearer — deliverWebhook resolves the
  run's publisher's subcommand_bearer (the demo seeded equal to
  MURMUR_TOKEN; new publishers get a random value). MURMUR_TOKEN no
  longer leaks across publishers via webhook delivery.
• Webhook HMAC — additive X-Murmur-Signature: t=<unix>,v1=<hmac>
  header; legacy bearer retained for backward compat (drop in M10).
• task_tool dispatch — switches from shared MURMUR_TOKEN to
  per-publisher subcommand_bearer via LEFT JOIN on the claim lookup.
• Admin API — POST /publishers, GET/PATCH /publishers/me,
  POST /publishers/me/tokens/{kind}/rotate,
  DELETE /publishers/me/tokens/{kind}/{id}, GET /publishers/me/audit.
• Boot-seed — idempotent demo publisher seed; grandfathers
  MURMUR_TOKEN as kinds=['admin','runner']. MURMUR_TOKEN rotation
  between boots is detected — stale grandfather row revoked, fresh row
  inserted; subcommand_bearer rotated in lockstep so task_tool
  dispatch stays in sync with jobseek's shim.
• Docs — docs/auth.md covers token model, lifecycle, HMAC
  verification (Node + Python samples), demo migration semantics, audit
  vocabulary, and known v1 limitations.

Definition of Done coverage

• Publisher record + four-token model in storage with migrations
• All existing endpoints scoped via token claims
• Token rotation API + audit log
• Webhook HMAC signing + sample verification doc
• Demo publisher (jobseek) migrated to new token model with no downtime
• Documentation in docs/auth.md

Folds in #77 (per-publisher namespace context for run ownership;
extending created_by is M2 scope).

Test plan

• pnpm typecheck — green
• pnpm lint — green
• pnpm grep:all — green
• pnpm test:unit — 380 tests pass (28 new tests for tokens,
  bootstrap seed, publisher_auth middleware, kinds_json codec,
  admin API, webhook HMAC, cross-publisher isolation)
• Manual smoke against deployed Murmur after merge: existing
  jobseek start-run.ts flow still triggers a run; webhook
  delivery still received with both Authorization: Bearer
  and X-Murmur-Signature headers.

Backward compat for the existing jobseek deploy

The demo publisher's MURMUR_TOKEN is grandfathered as
kinds_json=["admin","runner"], so:

• POST /pipelines (CI) — accepts MURMUR_TOKEN as admin ✓
• POST /pipelines/{id}/runs (form / start-run.ts) — accepts MURMUR_TOKEN
  as runner ✓
• Webhook delivery — still sends Authorization: Bearer <MURMUR_TOKEN>
  via the seeded subcommand_bearer = MURMUR_TOKEN ✓
• task_tool dispatch — sends Authorization: Bearer <MURMUR_TOKEN> via
  the same seeded value ✓

MURMUR_TOKEN rotation between boots is supported: the grandfather
token row AND the subcommand_bearer are both rotated to match the
new env value, keeping all four paths above in sync.

Known follow-ups (filed inline as comments)

• Per-publisher pipeline namespacing (composite (publisher_id, id)
  PK) — deferred until multiple non-demo publishers exist.
• Encryption-at-rest for webhook_signing_secret and
  subcommand_bearer — M2 scope.
• DNS rebinding defense in URL validation — v1 validates at
  registration only.
• last_used_at telemetry — deferred to avoid writer-lock contention
  on the auth hot path.
• Bootstrap rate limiting — MURMUR_BOOTSTRAP_TOKEN should be
  operator-only and rotated independently.

Closes #81
🤖 Generated with Claude Code