Add authentication: admin/agent bearer tokens for the API, login for the dashboard

control-api: every route now carries a mandatory access level (admin / agent /
open) in a route table. All /api/v1/admin/* require the admin token; the
write calls of validator-agent and prober (self-check, events, results,
complete) require a separate static agent token; register, heartbeat and
fetching the assignment stay open. Tokens come from env vars, are compared in
constant time and never logged. An empty token leaves that level open with a
startup warning (backward compatible).

validator-agent / prober: apiclient sends the agent token only to control-api.

admin-dashboard: login/password (from env) with a stateless HMAC session
cookie, Origin-based CSRF check, per-IP brute-force throttle, HX-Redirect for
htmx polls, logout in the sidebar; the dashboard calls control-api with the
admin token. Login page layout fixed after review.

Also: env plumbing in docker-compose/rxprod-compose/systemd/config examples,
e2e script with token assertions, tests, docs (API, SETUP, USAGE, DASHBOARD,
README), plan and review under docs/changes/, bin/ rebuilt with new
SHA256SUMS.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

cmd/admin-dashboard/main.go

@@ -39,11 +39,21 @@ func run(configPath string, log *slog.Logger) error {
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
 	defer stop()
 
+	controlAPIToken := os.Getenv(cfg.ControlAPI.TokenEnv)
+	if controlAPIToken == "" {
+		log.Warn("control-api admin token is not set: calls to control-api are sent without credentials", "env", cfg.ControlAPI.TokenEnv)
+	}
+
 	srv, err := dashboard.New(dashboard.Config{
 		ControlAPIBaseURL:     cfg.ControlAPI.BaseURL,
 		ControlAPITimeout:     time.Duration(cfg.ControlAPI.TimeoutSeconds) * time.Second,
 		LastCompletedCount:    cfg.Overview.LastCompletedCount,
 		OverviewPollIntervalS: cfg.Overview.PollIntervalSeconds,
+		ControlAPIToken:       controlAPIToken,
+		Username:              os.Getenv(cfg.Auth.UsernameEnv),
+		Password:              os.Getenv(cfg.Auth.PasswordEnv),
+		SessionSecret:         os.Getenv(cfg.Auth.SessionSecretEnv),
+		SessionTTL:            time.Duration(cfg.Auth.SessionTTLMinutes) * time.Minute,
 	}, log)
 	if err != nil {
 		return fmt.Errorf("init dashboard: %w", err)