Harden + test the Worker auth/identity gates

[cameronapak]

Part of #151

Question

Audit finding 4 (findings doc, from #159): the auth-boundary logic is untested and partly unhardened. One pass, four items:

1. Extract + test the pure gates — resolveUserId (worker/index.ts:118, the DO tenant-isolation key: a regression here cross-wires two users' outlines), isAdminSession (:441), isPlausibleEmail (:436), and the invite-code predicate (worker/auth.ts:60-78) have zero test references and e2e can't reach them (the mock intercepts /api/auth). Extract to a pure module (the outline-ops.ts pattern, e.g. worker/identity.ts) and add a .test.ts: routing key equals user.id never email; empty/whitespace INVITE_CODES denies all; unknown/empty code denied; admin allowlist case-insensitive and fail-closed when unset.
2. Assert BETTER_AUTH_SECRET — it is optional-typed and passed unguarded (worker/auth.ts:24,38); the "Better Auth fails closed in prod" comment is unverified library behavior. Add an explicit non-empty assertion at createAuth.
3. Pin admin identity to user.id instead of an (unverified) email — closes the register-the-admin-email-first path permanently, even though the precondition is already false in prod.
4. SSRF nit — isPrivateIpv4 (worker/unfurl-core.ts:29) misses IPv4-mapped IPv6 ([::ffff:127.0.0.1]). Integer/hex forms are NOT a gap (WHATWG URL canonicalizes them); Cloudflare's platform block covers this anyway. One-line belt-and-suspenders while in the area.

[cameronapak]

Built in PR #281 (closes on merge). All four items landed:

1. Pure gates extracted + tested — resolveUserId, isAdminSession, isPlausibleEmail, and the shared-invite-code predicate now live in worker/identity.ts with worker/identity.test.ts (16 cases). Pins asserted: DO routing key = user.id, never email (incl. near-miss non-bridging); empty/whitespace INVITE_CODES denies all; unknown/empty code denied; admin allowlist fail-closed and case-correct.
2. BETTER_AUTH_SECRET asserted non-empty at createAuth — 500s loudly on a missing/empty secret instead of the unverified "Better Auth fails closed".
3. Admin pinned to user.id via a new ADMIN_USER_IDS var (takes precedence over ADMIN_EMAILS, which stays as a fallback). Left unset in wrangler.jsonc so nothing breaks on deploy — flip it on to your user.id to close the register-the-admin-email-first path. A wrong id locks admin until fixed, so it's a deliberate manual step (documented in the wrangler comment + PR).
4. SSRF — the unfurl guard now blocks IPv4-mapped IPv6 (::ffff:127.0.0.1 and its canonical hex ::ffff:7f00:1), with dotted + hex test cases through the real isAllowedUnfurlTarget.

Gates: full bun test src worker/ 678 pass, typecheck ×3 / lint / fmt green.

[cameronapak]

Resolved: PR #281 rebased onto main (clean; one import-block conflict from the off-site-backup #283 merge, both sides kept) and squash-merged 2026-07-17. All gates green (773 tests pass). Security-sensitive resolutions verified fail-closed: invite gate rejects on unset INVITE_CODES + no per-email match; ADMIN_USER_IDS left unset (documented manual flip); BETTER_AUTH_SECRET now fail-loud at createAuth.