Authenticate the loopback review API #12

Outcome

Possession of the endpoint file alone is not enough for another local process
to read or mutate Markover reviews.

The selected boundary is the local OS account: callers that can reach loopback
but cannot read the protected capability are denied. Same-user malicious
processes and privileged/root processes remain explicitly out of scope.

Acceptance criteria

• Each running service process uses a fresh cryptographically random
  capability token and instance ID.
• Endpoint and token records are atomically published with restrictive
  POSIX permissions.
• Every non-health route requires authenticated access before routing or
  body processing.
• CLI and application clients propagate credentials without exposing them
  in normal output or logs.
• Unauthorized list, read, create, handoff, edit, and import attempts are
  covered across every route that exists; unknown routes remain centrally
  gated. Separate attachment and deletion HTTP routes do not currently exist.
• Restart, stale-endpoint, mismatched-pair, ordinary stale-port collision,
  and recovery behavior are deterministic; malicious same-user stale-port
  impersonation is documented as out of scope.
• The privacy/data documentation accurately describes the final trust
  boundary, stored provenance, agent handoff, local discovery control,
  retention, and deliberate network edges.

Completed PR stack

Bottom to top:

1. Capability boundary — merged PR Add local API capability authorization #41. Capability generation, protected
   publication, server authorization, minimum shared-client propagation,
   redacted opt-in diagnostics, and the reusable development smoke fixture.
2. Recovery hardening — merged PR Harden local authorization recovery #56. Restart and stale-record behavior,
   mismatched endpoint/token pairs, ordinary stale-port consistency checking,
   bounded in-place repair, restart-required failure, and no replay after
   ambiguous transmission. The public instance ID is a consistency name tag,
   not cryptographic protection against malicious same-user impersonation.
3. Adversarial verification and public claims — draft PR Verify local authorization and publish privacy boundaries #67. Layered
   real-HTTP denial across every current route, hostile credential forms,
   standards-valid Bearer parsing, local-session-discovery control, inert
   remote-image evidence, public privacy/data documentation, and the canonical
   complete-system ELI5.

Protocol 2 is a clean pre-preview break. This stack does not add protocol-1
fallback, speculative compatibility machinery, or migrations solely to make
historical review JSON openable by the latest app.

Final evidence

• Draft PR #67
• Reviewed final-slice plan
• Public privacy and local-data page
• npm run check and all 243 tests pass on the PR branch.

Related ownership

Issue #39 independently owns bounded-loss autosave durability across crashes
and restarts. Restarts do not require draining review handoffs. Issue #13
reuses the happy-path protocol/restart smoke against final packaged artifacts
rather than duplicating adversarial authorization or durability coverage.
Issue #9 owns broader preview and cleanup documentation, issue #15 owns usable
review/attachment deletion, and issue #64 owns the future in-app privacy link.