security: auth bypass via path-suffix matching in require_auth #329

Problem

require_auth (crates/trapfalld/src/auth.rs:244-250) decides public routes with path.ends_with("/setup"), ends_with("/auth/login"), ends_with("/auth/logout") and path.contains("/envelope/"). Dashboard routes embed user-controlled slugs (/api/0/projects/{slug}/...), and create_project does no slug validation.

Scenario

A project with slug setup or envelope makes GET/PATCH/DELETE /api/0/projects/setup and /api/0/projects/envelope/issues|search skip authentication.

Fix

• Match exact paths (==) and /api/{id}/envelope/ by segment.
• Reject reserved slugs on project create/update.
• Preferably split public and protected routers instead of string matching in one middleware (protected_routes() already exists but is unused).
• Add regression tests for slugs setup, envelope, login.

Found in static audit of develop @ db3ca67.