fix(security): fail closed in production; arm registry auth by default

GHSA-4f7g-w95g-5q2c (CVSS 9.8) — the default registry deploy ran in
header-trust mode: with ROBOCO_AGENT_AUTH_REQUIRED unset and cloud auth
off, require_panel_token / _check_agent_auth_token returned without
verifying a credential, so any client reaching the API could write
settings and claim X-Agent-Role: ceo with no token. Binding :8000 to
loopback (c4053d5f) closed the direct path but not nginx :3000, which
proxies /api/ to the orchestrator and passes client X-Agent-* through.

Root cause: header-trust is the default even in production. _auth_required
now fails closed when settings.environment == production (the registry
compose already declares it) — an explicit false still opts out for a
trusted private network. The registry compose arms auth by default and
requires ROBOCO_PANEL_AGENT_TOKEN so nginx injects a valid CEO token and
the panel keeps working. The CEO's NAS deploy is unaffected: it runs
cloud auth, which already enforced tokens on every role.

tests/unit/api/test_deps.py

@@ -184,12 +184,30 @@ def test_auth_required_truthy_values(monkeypatch: pytest.MonkeyPatch) -> None:
         assert _auth_required() is True
 
 
-def test_auth_required_falsy_values(monkeypatch: pytest.MonkeyPatch) -> None:
-    for v in ("0", "no", "false", ""):
+def test_auth_required_explicit_false_values(monkeypatch: pytest.MonkeyPatch) -> None:
+    # An explicit opt-out is honored in every environment (trusted private net).
+    monkeypatch.setattr(_deps.settings, "environment", "production")
+    for v in ("0", "no", "false"):
         monkeypatch.setenv("ROBOCO_AGENT_AUTH_REQUIRED", v)
         assert _auth_required() is False
 
 
+def test_auth_required_unset_fails_open_in_dev(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.delenv("ROBOCO_AGENT_AUTH_REQUIRED", raising=False)
+    monkeypatch.setattr(_deps.settings, "environment", "development")
+    assert _auth_required() is False
+
+
+def test_auth_required_unset_fails_closed_in_production(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    # GHSA-4f7g-w95g-5q2c: an unset flag must not leave a production deploy in
+    # header-trust mode where any client can claim X-Agent-Role: ceo.
+    monkeypatch.delenv("ROBOCO_AGENT_AUTH_REQUIRED", raising=False)
+    monkeypatch.setattr(_deps.settings, "environment", "production")
+    assert _auth_required() is True
+
+
 def test_check_agent_auth_token_no_token_in_dev_passes(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None: