fix(security): require auth token on partner & admin endpoints

[devin-ai-integration]

Summary

Security scan of the codebase. The one critical issue was broken access control: every partner and admin endpoint was completely unauthenticated. Anyone on the internet could read all customer PII (name + phone) via GET /admin/orders and GET /partners/{id}/orders, issue arbitrary refunds via POST /admin/refund/{id}, mark orders redeemed via POST /redeem, and publish boxes as any partner via POST /boxes.

This PR adds fail-closed, token-based auth to those endpoints. The customer-facing storefront (catalog, booking, payment, "my orders") stays public.

What changed

New app/auth.py with two header-based dependencies backed by env vars:

def _require(provided, env_name, role):
    expected = os.environ.get(env_name)
    if not expected:
        raise HTTPException(503, ...)          # fail closed: unset => endpoint disabled
    if not provided or not secrets.compare_digest(provided, expected):
        raise HTTPException(401, ...)

require_admin   -> checks X-Admin-Token   against ADMIN_TOKEN
require_partner -> checks X-Partner-Token against PARTNER_TOKEN

Wired as dependencies=[Depends(require_partner|require_admin)] on:

• Partner: POST /boxes, GET /partners/{id}/orders, POST /redeem
• Admin: GET /admin/stats, GET /admin/orders, POST /admin/refund/{id}

Frontend (index.html) prompts for the token when switching to the Partner/Admin tab, stores it in localStorage, and sends it as a header on every request (clears it on 401). render.yaml gets generateValue: true for both tokens so prod is secure by default; README documents the scheme.

Uses secrets.compare_digest (constant-time) and fail-closed defaults so a misconfigured deploy denies rather than exposes.

Scan results for the rest

• SQL injection — none; all queries in db.py are parameterized.
• XSS — frontend escapes all interpolated data via esc(); QR SVG is server-generated.
• Hardcoded secrets — none found.
• CORS — no CORSMiddleware configured, so default same-origin; not misconfigured.
• Debug endpoints — POST /admin/seed was already gated by local_only.

Follow-ups (not in this PR)

• Per-partner authorization: a valid PARTNER_TOKEN currently grants access to any partner's data; real per-partner credentials are a follow-up.
• Dependencies use unbounded >= ranges — consider pinning for supply-chain safety.

Testing

• Added tests/test_auth.py (added httpx for TestClient): storefront stays public; admin/partner endpoints return 503 when the env token is unset, 401 on missing/wrong token, 200 with the correct token.
• pytest — 13 passed.

Link to Devin session: https://app.devin.ai/sessions/fe1a1300a37e40c2b18cc8f1793426c8
Requested by: @wpalish

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring