feat!: the token on every route, Secure Config Only goes (step 4b)

Under Secured every HTTP route but the public ones needs the token
(docs/adr/0006-two-security-modes-eleven-http-routes.md):
- isPublicRoute, isWebAsset and originMatchesHost in src/HttpAccess.h,
  with native tests.
- One middleware checks the token. It runs once the body is in, so
  /restore, /updateFirmware and /updateApplication check it on their
  first chunk and drop a refused upload.
- Static serving answers the web UI's files only: shades.cfg and
  shades.tmp are no longer served.
- The wildcard CORS headers go; WEB_CORS turns them back on for UI work
  from file://.
- The socket refuses a handshake whose Origin doesn't name its Host.
- "Secure Config Only" goes: a device set to it is Secured, and
  /loginContext drops permissions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/test_routes.py

@@ -0,0 +1,127 @@
+"""The HTTP routes and the socket's Origin check under the device's security
+mode (docs/adr/0006-two-security-modes-eleven-http-routes.md).
+
+Like test_auth, it tests the mode it finds: pass --password or --pin for a
+Secured device.
+"""
+import time
+import urllib.error
+import urllib.request
+
+import pytest
+
+from proto_client import ProtoClient, heap
+
+# Every route that needs the token under Secured, sent without a body or
+# parameters, so a route that let one through would still change nothing.
+TOKEN_ROUTES = [
+    ("GET", "/backup"),
+    ("GET", "/shadeCommand"),
+    ("GET", "/groupCommand"),
+    ("GET", "/tiltCommand"),
+    ("PUT", "/shadeCommand"),
+    ("PUT", "/groupCommand"),
+    ("PUT", "/tiltCommand"),
+]
+PUBLIC_ROUTES = ["/", "/index.html", "/index.js", "/loginContext", "/upnp.xml"]
+SHADE_FILES = ["/shades.cfg", "/shades.tmp"]
+
+
+def http(host, path, method="GET", body=None, headers=None):
+    """The status and headers of a request, refusals included."""
+    req = urllib.request.Request(f"http://{host}{path}", data=body, method=method, headers=headers or {})
+    try:
+        with urllib.request.urlopen(req, timeout=20) as r:
+            r.read()
+            return r.status, r.headers
+    except urllib.error.HTTPError as e:
+        e.read()
+        return e.code, e.headers
+
+
+def upload(host, path, headers=None):
+    """Posts a small file that isn't a backup or an image."""
+    boundary = "e2e-upload"
+    body = (
+        f"--{boundary}\r\nContent-Disposition: form-data; name=\"file\"; filename=\"e2e.bin\"\r\n"
+        "Content-Type: application/octet-stream\r\n\r\n").encode() + b"\0" * 256 + f"\r\n--{boundary}--\r\n".encode()
+    return http(host, path, "POST", body, {"Content-Type": f"multipart/form-data; boundary={boundary}", **(headers or {})})
+
+
+@pytest.mark.parametrize("method,path", TOKEN_ROUTES)
+def test_secured_refuses_a_route_without_a_token(host, secured, method, path):
+    if not secured:
+        pytest.skip("the device's security is None")
+    body = b"{}" if method == "PUT" else None
+    status, _ = http(host, path, method, body, {"Content-Type": "application/json"} if body else None)
+    assert status == 401
+
+
+@pytest.mark.parametrize("method,path", TOKEN_ROUTES)
+def test_secured_refuses_a_route_with_a_wrong_token(host, secured, method, path):
+    if not secured:
+        pytest.skip("the device's security is None")
+    body = b"{}" if method == "PUT" else None
+    headers = {"apikey": "0" * 64}
+    if body:
+        headers["Content-Type"] = "application/json"
+    status, _ = http(host, path, method, body, headers)
+    assert status == 401
+
+
+def test_secured_accepts_the_token_on_a_route(host, secured, token):
+    if not secured:
+        pytest.skip("the device's security is None")
+    status, _ = http(host, "/backup", headers={"apikey": token})
+    assert status == 200
+
+
+@pytest.mark.parametrize("path", ["/restore", "/updateFirmware"])
+def test_secured_drops_an_upload_without_a_token(host, secured, token, path):
+    """The token check runs once the body is in, so the uploads check it on their first chunk.
+
+    An /updateFirmware that got through would stop the radio and reboot the
+    device once the connection closed.  /updateApplication isn't sent: one
+    that got through would write over the file system.
+    """
+    if not secured:
+        pytest.skip("the device's security is None")
+    before = heap(host, token)
+    status, _ = upload(host, path)
+    assert status == 401
+    after = heap(host, token)
+    assert after["uptime"] >= before["uptime"], "the device rebooted"
+
+
+@pytest.mark.parametrize("path", PUBLIC_ROUTES)
+def test_public_routes_need_no_token(host, path):
+    status, _ = http(host, path)
+    assert status == 200
+
+
+@pytest.mark.parametrize("path", SHADE_FILES)
+def test_the_shade_files_are_not_served(host, path):
+    """Their rolling codes leave the device only through /backup."""
+    status, _ = http(host, path)
+    assert status in (401, 404)
+
+
+def test_replies_carry_no_cors_headers(host):
+    _, headers = http(host, "/loginContext", headers={"Origin": "http://example.com"})
+    assert headers.get("Access-Control-Allow-Origin") is None
+
+
+def test_a_socket_from_another_site_is_refused(host, token):
+    params = {"apikey": token} if token else None
+    c = ProtoClient(host, params=params, headers={"Origin": "http://example.com"})
+    assert c.status == 401
+
+
+def test_a_socket_from_the_page_the_device_served_is_accepted(host, token):
+    # ProtoClient's Host names the port, and so does an Origin that matches it.
+    params = {"apikey": token} if token else None
+    c = ProtoClient(host, params=params, headers={"Origin": f"http://{host}:80"})
+    assert c.status == 101
+    c.close()
+    # The device frees the slot when it sees the disconnect.
+    time.sleep(0.5)