kami
d29e7ba813
/api/chat reaches the router, the LLM and, through applyAction, the whole act path, so it is the widest state-changing surface mavweb serves. It was the only one with no gate. It now goes through stepUpOK like POST /tools, POST /routines and POST /api/revert: unchanged in the default deploy (WebAuthn unconfigured, fail-open behind wg+nginx), 403 under -require-stepup or an unasserted passkey session. The route table now carries an explicit enumeration of every state-changing route and its gate, and the two startup SECURITY log lines name /routines and /api/chat alongside /tools and /api/revert. The loopback -addr default the task also asked for landed earlier in d12de58; the compose already publishes mavweb on 127.0.0.1 only.