Module auth 

Control-plane auth assembly: build the Auth from the resolved root-key settings, and the fail-closed bind guard that refuses to expose an unauthenticated control plane on a public listener.

Moved out of the boatramp binary’s serve path so an in-process embedder — or a fidelity test — assembles auth exactly as boatramp serve does.

Functions

configure_auth

Build the control-plane Auth from the resolved root-key settings (flag/env > serve config). For an issuing node (a private key or an external signer) it also sets options.issuer so the token-create and OIDC-exchange routes can mint. No key ⇒ auth disabled (dev).

enforce_auth_bind

Fail-closed bind guard: refuse to expose an unauthenticated control plane on a non-loopback listener unless the posture explicitly allows it, and warn loudly for any auth-disabled listener.