Fail closed for server and local endpoint authentication

[DerekTan1]

Summary

• fail closed when the non-development server gateway access key is unset or mismatched
• require bearer authentication on all local development execution, polling, and secrets endpoints
• propagate and validate the local endpoint token through runners, Docker Compose, and Helm settings
• add regression coverage for server, endpoint, task-runner, and secrets-provider authentication

Production rollout note

Non-development server deployments must configure PCTASKS_SERVER__ACCESS_KEY and the gateway must send the matching X-Access-Key. Deployments without that configuration will intentionally return 401 instead of trusting forwarded identity headers.

The local endpoint token only applies when local_dev_endpoints_url is configured; normal production Batch/Argo deployments are unaffected.

Validation

• focused pytest coverage: 10 passed
• Black, isort, and flake8 checks passed
• mypy passed for all modified production modules
• Docker Compose config validation passed
• Docker runtime smoke test passed for missing, invalid, and valid credentials, including authenticated execute/poll and secrets client requests

Fixes CWE-290 and CWE-306 findings from the security review.