Motivation

• Dual-auth/edge mode (allow_unauthenticated=true) allowed TLS handshakes without client certs but did not enforce any application-layer token checks, leaving the gateway control plane exposed.

Description

• Add a new edge_auth helper module (crates/openshell-server/src/edge_auth.rs) that recognizes edge tokens from cf-authorization, authorization: Bearer ..., and the CF_Authorization cookie for both HTTP and gRPC metadata.
• Enforce application-layer checks for gRPC by wrapping the OpenShell and Inference services with an interceptor in MultiplexService that returns UNAUTHENTICATED when dual-auth mode is enabled and no edge token is present (crates/openshell-server/src/multiplex.rs).
• Protect the WebSocket tunnel upgrade by rejecting /_ws_tunnel with HTTP 401 when dual-auth mode is enabled and the upgrade request lacks an edge token (crates/openshell-server/src/ws_tunnel.rs).
• Wire the new module into the server crate and update the integration test expectations and architecture docs to reflect enforced application-layer auth in dual-auth mode (crates/openshell-server/src/lib.rs, crates/openshell-server/tests/edge_tunnel_auth.rs, architecture/gateway-security.md).

Testing

• Ran cargo fmt --all which completed successfully to ensure formatting consistency.
• Attempted targeted server checks and tests via cargo check -p openshell-server --lib and cargo test -p openshell-server edge_tunnel_auth -- --nocapture, but full test completion was blocked in this environment due to long native dependency compilation and network/tooling restrictions; partial compilation proceeded but the full test run did not finish.
• Unit tests for the new edge_auth helpers were added and exercised locally where the build proceeded; a full CI run is recommended to validate all integration tests in a normal build environment using mise run pre-commit and cargo test -p openshell-server.

Codex Task