flower /mcp HTTP auth — config-gated bearer middleware

You are being dispatched from flower Brief #277: flower /mcp HTTP auth — config-gated bearer middleware

Recall pointer:
- Use recall_brief with id 277 for the full folder if you need provenance.

Target:
- project: flower (/Users/mikeferrara/Documents/code/flower)
- branch: choose an appropriate branch
- worktree: not specified
- kind: fresh

Current brief spec:
# flower /mcp HTTP auth — config-gated bearer middleware

**Overnight auto-dispatch, review-gated.** Parent epic #263. Closes the unauthenticated-`/mcp` gap flagged during tonight's remote-worker build.

## Problem
`Mcp::web('/mcp', FlowerServer::class)` (routes/ai.php:17) is served with **no auth** — the code comment literally calls auth "a future middleware/auth seam." Remote flower-agents reach it over the tailnet; without auth, any tailnet (or wider, if exposed) client can call flower's full write surface.

## Goal
A **config-gated bearer-token middleware** on the `/mcp` HTTP route: enforce when a token is configured, backward-compatible (open) when not, and **leave the stdio server untouched**.

## Spec
1. **Config:** add `flower.mcp.http_token` (env `FLOWER_MCP_HTTP_TOKEN`, default null/empty) in config/flower.php.
2. **Middleware:** only when `flower.mcp.http_token` is non-empty, require `Authorization: Bearer <token>` matching it via constant-time `hash_equals`; return **401** on missing/mismatch. When the config token is empty → pass through (today's behavior; local dev unbroken).
3. **HTTP route only:** attach it to `Mcp::web('/mcp', …)` in routes/ai.php. **Do NOT touch `Mcp::local('flower', …)`** (stdio; used by the daemons + interactive sessions — must keep working with zero change).

## Acceptance
- `php artisan test` green, with new tests: (a) token set + no/incorrect bearer → 401; (b) token set + correct bearer → normal MCP response; (c) token unset → open (backward-compat); (d) stdio flower MCP unaffected.
- `./vendor/bin/pint` clean on changed files.

## Non-goals
- `tailscale serve` exposure of flower.test (brief #110 — separate).
- Per-user/per-request identity (single shared token is fine for v1).

## Notes
- The remote `flower-agent` wrapper (bin/flower-agent, committed tonight) already sends `Authorization: Bearer $FLOWER_MCP_TOKEN` when set — so enabling later = set `FLOWER_MCP_HTTP_TOKEN` on the server + the matching token in the worker env. This brief is the server half.
- **Review-gated:** mandatory adversarial review before merge (security-sensitive).

Recent/key trace events:
[1] participant_joined claude-interactive: (no body)
[2] note_added claude-interactive: Add auth to flower's HTTP /mcp route (Mcp::web('/mcp', FlowerServer::class), routes/ai.php) — a config-gated bearer-token middleware (FLOWER_MCP_HTTP_TOKEN): enforce a 401 when the token is set, backward-compatible (open) when unset so local dev isn't broken; the stdio Mcp::local('flower') server (used by daemons + interactive sessions) stays UNTOUCHED. Closes the unauthenticated-/mcp gap (flagged tonight) and lets the remote flower-agent wrapper (already supports FLOWER_MCP_TOKEN) authenticate over the tailnet. Overnight auto-dispatch, review-gated. Full spec to follow.
[3] plan_proposed claude-interactive: # flower /mcp HTTP auth — config-gated bearer middleware

**Overnight auto-dispatch, review-gated.** Parent epic #263. Closes the unauthenticated-`/mcp` gap flagged during tonight's remote-worker build.

## Problem
`Mcp::web('/mcp', FlowerServer::class)` (routes/ai.php:17) is served with **no auth** — the code comment literally calls auth "a future middleware/auth seam." Remote flower-agents reach it over the tailnet; without auth, any tailnet (or wider, if exposed) client can call flower's full write surface.

## Goal
A **config-gated bearer-token middleware** on the `/mcp` HTTP route: enforce when a token is configured, backward-compatible (open) when not, and **leave the stdio server untouched**.

## Spec
1. **Config:** add `flower.mcp.http_token` (env `FLOWER_MCP_HTTP_TOKEN`, default null/empty) in config/flower.php.
2. **Middleware:** only when `flower.mcp.http_token` is non-empty, require `Authorization: Bearer <token>` matching it via constant-time `hash_equals`; return **401** on missing/mismatch. When the config token is empty → pass through (today's behavior; local dev unbroken).
3. **HTTP route only:** attach it to `Mcp::web('/mcp', …)` in routes/ai.php. **Do NOT touch `Mcp::local('flower', …)`** (stdio; used by the daemons + interactive sessions — must keep working with zero change).

## Acceptance
- `php artisan test` green, with new tests: (a) token set + no/incorrect bearer → 401; (b) token set + correct bearer → normal MCP response; (c) token unset → open (backward-compat); (d) stdio flower MCP unaffected.
- `./vendor/bin/pint` clean on changed files.

## Non-goals
- `tailscale serve` exposure of flower.test (brief #110 — separate).
- Per-user/per-request identity (single shared token is fine for v1).

## Notes
- The remote `flower-agent` wrapper (bin/flower-agent, committed tonight) already sends `Authorization: Bearer $FLOWER_MCP_TOKEN` when set — so enabling later = set `FLOWER_MCP_HTTP_TOKEN` on the server + the matching token in the worker env. This brief is the server half.
- **Review-gated:** mandatory adversarial review before merge (security-sensitive).
[4] parent_set claude-interactive: Grouped under epic #263.
[5] review_requested claude-interactive: Security-sensitive: verify the bearer middleware is applied ONLY to the Mcp::web('/mcp') HTTP route (stdio Mcp::local untouched), is config-gated (open when FLOWER_MCP_HTTP_TOKEN unset — backward-compatible), uses constant-time comparison, and that tests cover the 401 / correct-bearer / unset / stdio-unaffected cases. Do not merge if local/daemon flower MCP usage could break.
[6] status_change claude-interactive: (no body)

Recommended linked context:
{
    "todos": [],
    "scratchpads": []
}

Execution notes:
- Treat the brief as the source of truth.
- Keep work scoped to this dispatch request.
- Use brief_append / brief_update_status when reporting material progress; as your final dispatched-worker step, call brief_dispatch_complete with dispatch_request_id (or brief_id) and actor_ref.
- Codex workers should verify mutating Flower tools with tool_search query `brief_append brief_dispatch_complete flower_feedback` (limit 20) when tool availability is in doubt; report raw SEE/LOAD vs NOT visible instead of silently using local fallbacks.
- Add a git commit trailer `Brief: #277` to every commit for this brief so flower can exact-link commits back to the brief.
- Need an operator call while working this brief? A question ABOUT THIS BRIEF -> brief_ask(277, ...); a standalone decision not tied to the brief -> decision_ask(...). Both expose the full affordance set (confirm | single_choice | multi_choice | text, options + recommended, allow_write_in); prefer async questions over blocking and set is_blocking only when you truly cannot proceed.
- Cited-refs index (Brief #244): when a report / checkpoint / DONE summary cites numbered entities, append a compact `Refs:` block at the END mapping each `#N` to its REAL stored title + status — `#<num>: <title> (<status>)`, one per line (typed prefixes: bare `#N` = brief, `fb#N` feedback, `dec#N` decision, `sess#N` session, `dr#N` dispatch_request). Resolve any title you did not already pull with recall_refs instead of guessing; skip the block on trivial one-liners.