Require auth on /api/v1/ and derive capability guards server-side

Findings 1 and 2 of REVIEW-2026-07-30.md, which must land together: every
workspace capability registered with enabled=false, so the only working
provider could never execute. Fixing that alone would have turned a dead
execution path into a reachable one on an unauthenticated port.

Auth: a shared bearer token (HEXIS_API_TOKEN) is now required on the whole
/api/v1/ surface, compared with crypto/subtle.ConstantTimeCompare. /health
and /ready stay open for probes. It fails closed twice over — hexisd refuses
to start with an empty token, and the middleware returns 503 rather than ever
serving unauthenticated.

Guards: `enabled` and `requires_confirmation` are no longer readable from the
request body at all. Previously the handler derived the correct §4.3 default
and then let the caller override it, which is worse than no guard because it
reads as enforced. Both are now derived from the risk tier by shared helpers
in domain, used by the HTTP and provider registration paths alike;
unrecognised tiers fail closed to requiring confirmation.

BuildCapabilities sets Enabled, RequiresConfirmation and TimeoutSeconds
explicitly, and hexisd reconciles drifted rows on startup instead of skipping
any capability whose ID already exists — without that, allowlist edits never
reach an existing database.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uea55zaiWuEByEDC4UBSdd

cmd/hexisctl/main.go

@@ -28,7 +28,7 @@ func main() {
 		os.Args = append(os.Args[:1], os.Args[3:]...)
 	}
 
-	cli = client.New(baseURL)
+	cli = client.New(baseURL).WithToken(os.Getenv("HEXIS_API_TOKEN"))
 
 	cmd := os.Args[1]
 	args := os.Args[2:]

cmd/hexisd/main.go

@@ -7,9 +7,12 @@ import (
 	"os"
 	"os/signal"
 	"path/filepath"
+	"slices"
 	"syscall"
+	"time"
 
 	"github.com/kami/hexis/internal/api"
+	"github.com/kami/hexis/internal/domain"
 	"github.com/kami/hexis/internal/execution"
 	"github.com/kami/hexis/internal/mcp"
 	"github.com/kami/hexis/internal/nexusclient"
@@ -79,10 +82,26 @@ func main() {
 			log.Printf("discovered %d workspace tools, %d in allowlist", len(tools), len(allowlist.Tools))
 		}
 
-		// Register workspace capabilities
+		// Register workspace capabilities, reconciling existing rows so that
+		// allowlist edits (risk tier, target type, enabled) reach a database
+		// that was populated by an earlier build.
 		for _, cap := range wsProvider.BuildCapabilities() {
 			existing, err := store.GetCapability(cap.ID)
 			if err == nil && existing != nil {
+				if !capabilityMatches(existing, &cap) {
+					merged := cap
+					merged.CreatedAt = existing.CreatedAt
+					merged.UpdatedAt = time.Now().UTC()
+					merged.Attributes = existing.Attributes
+					// UpdateCapability is optimistically concurrent: it matches
+					// on the current version and bumps it.
+					merged.Version = existing.Version
+					if err := store.UpdateCapability(&merged); err != nil {
+						log.Printf("warning: reconcile capability %s: %v", cap.Name, err)
+					} else {
+						log.Printf("reconciled capability: %s -> %s (version %d)", merged.Name, merged.Operation, merged.Version)
+					}
+				}
 				continue
 			}
 			if err := store.CreateCapability(&cap); err != nil {
@@ -124,3 +143,20 @@ func main() {
 	srv.Shutdown(ctx)
 	log.Println("stopped")
 }
+
+// capabilityMatches reports whether the stored capability already carries every
+// derived field, ignoring bookkeeping (timestamps, version, attributes).
+func capabilityMatches(stored, derived *domain.Capability) bool {
+	return stored.Name == derived.Name &&
+		stored.Description == derived.Description &&
+		slices.Equal(stored.TargetTypes, derived.TargetTypes) &&
+		stored.TargetEntityID == derived.TargetEntityID &&
+		stored.Provider == derived.Provider &&
+		stored.Operation == derived.Operation &&
+		stored.Risk == derived.Risk &&
+		stored.ReadOnly == derived.ReadOnly &&
+		stored.ExpectedSideEffects == derived.ExpectedSideEffects &&
+		stored.RequiresConfirmation == derived.RequiresConfirmation &&
+		stored.Enabled == derived.Enabled &&
+		stored.TimeoutSeconds == derived.TimeoutSeconds
+}