Make delivery and integration failures explicit

Persist reminder presentations and retry state, atomically complete collapsed deliveries, fall back across away reaches, and block permanent failures visibly (V-715, V-678). Fail closed when enabled integrations lack credentials and keep remote arms explicitly dark (V-691). Give mavweb one sanitized, request-correlated error contract (V-689). Owner explicitly requested direct commits to master.

deploy/cw2/test_serve.py

@@ -0,0 +1,24 @@
+import unittest
+
+import serve
+
+
+class ListenerAuthTest(unittest.TestCase):
+    def test_network_listener_requires_token(self):
+        for host in ("0.0.0.0", "192.168.1.105", "::"):
+            for token in ("", "   "):
+                with self.subTest(host=host, token=token):
+                    with self.assertRaises(ValueError):
+                        serve.validate_listener_auth(host, token)
+
+    def test_loopback_listener_may_be_explicitly_unauthenticated(self):
+        for host in ("127.0.0.1", "::1", "localhost"):
+            with self.subTest(host=host):
+                serve.validate_listener_auth(host, "")
+
+    def test_network_listener_accepts_token(self):
+        serve.validate_listener_auth("0.0.0.0", "secret")
+
+
+if __name__ == "__main__":
+    unittest.main()