feat(api): expose REST-only agent routes

tests/auth/agentAuth.test.ts

@@ -0,0 +1,48 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import type { NextFunction, Request, Response } from "express";
+
+import { requireAgentAuth } from "../../src/auth/agentAuth.js";
+
+const originalFetch = globalThis.fetch;
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+describe("requireAgentAuth", () => {
+  it("preserves dependency outages without exposing upstream response text", async () => {
+    globalThis.fetch = (async () =>
+      new Response("postgresql://secret-host/internal-table", {
+        status: 503,
+      })) as unknown as typeof fetch;
+    const headers: Record<string, string> = {
+      authorization: "Bearer token",
+      "x-project-id": "project-id",
+    };
+    const req = {
+      header: (name: string) => headers[name.toLowerCase()],
+    } as Request;
+    let status = 200;
+    let body: unknown;
+    const res = {
+      status: (value: number) => {
+        status = value;
+        return res;
+      },
+      json: (value: unknown) => {
+        body = value;
+        return res;
+      },
+    } as unknown as Response;
+    let nextCalled = false;
+
+    await requireAgentAuth(req, res, (() => {
+      nextCalled = true;
+    }) as NextFunction);
+
+    expect(status).toBe(503);
+    expect(body).toEqual({ message: "authentication service unavailable" });
+    expect(JSON.stringify(body)).not.toContain("secret-host");
+    expect(nextCalled).toBe(false);
+  });
+});