core: the API has no authentication whatsoever

[joelpeace48-cell]

Problem

No route requires credentials. src/index.ts registers CORS and two route
plugins, and that is the whole security model. Every endpoint added from here —
attestation submission, usage ingestion, admin operations — inherits open
access by default, which is the wrong direction to build in.

What to do

Establish the auth layer before more routes land:

• Gateway credentials — API keys for machine clients. Store a hash, never
  the key. Prefix keys so they are detectable in leak scanning, and support
  rotation with an overlap window.
• Operator sessions — short-lived JWTs for humans, for the dashboard.
• A Fastify preHandler that is applied by default and must be explicitly
  opted out of for public routes. Deny by default; an endpoint that forgets to
  declare auth should fail closed, not open.
• Scopes: attest:write, usage:write, export:read, admin.

Acceptance criteria

• Keys stored hashed with per-key salt
• Auth applied by default, opt-out explicit and reviewed
• Scope enforcement with tests per scope
• Rotation supported without downtime

Notes

Blocks the attestation, usage, and export endpoints. Worth doing first —
retrofitting auth across a grown route surface is where gaps get left.

[thebabalola]

This is the same gap I closed on another Stellar backend last week: a requireAuth middleware verifying Bearer JWTs (signature, expiry, sub presence), rejecting missing/tampered/expired tokens with 401 before any handler runs, and attaching the verified identity to the request so routes never trust client-supplied identifiers. I'll wire it across the route table, keep public routes explicitly allowlisted, and include negative tests for spoofed headers and tampered payloads. Can start immediately.

[joelpeace48-cell]

@thebabalola, you are assigned, ensure all ci pipeline passes.

[grantfox-oss]

🦊 GrantFox — @thebabalola has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #42)
2. Your PR will be reviewed by the FinesseStudioLab maintainers

Good luck! Track your progress on GrantFox.

[thebabalola]

Hi — PR for the auth layer is up: #77. Implements gateway API keys (hashed, prefixed, rotation overlap) and operator JWTs with default-deny and scope checks. All 81 tests passing locally.