fix(server): put /api/status behind password auth

Only /api/health remains public for liveness probes. /api/status
exposes hostname, version, and server ID which shouldn't be
accessible without authentication.

packages/server/src/server/auth.ts

@@ -122,6 +122,5 @@ export function shouldBypassBearerAuth(method: string, path: string): boolean {
   if (method === "OPTIONS") {
     return true;
   }
-  // Public liveness/version endpoints used by local supervisors and health probes.
-  return path === "/api/health" || path === "/api/status";
+  return path === "/api/health";
 }

packages/server/src/server/bootstrap-auth.test.ts

@@ -97,7 +97,7 @@ describe("daemon bearer auth", () => {
       expect(health.status).toBe(200);
 
       const status = await fetch(`http://127.0.0.1:${daemonHandle.port}/api/status`);
-      expect(status.status).toBe(200);
+      expect(status.status).toBe(401);
     } finally {
       await daemonHandle.close();
     }