[BUG] [v0.0.7] app-server router does not enforce configured auth middleware #189

Summary

cortex-app-server defines an authentication system (AuthConfig, auth_middleware) but the router never applies it.

Evidence

create_router_with_state wires only tracing and permissive CORS before handing out AppState:

• src/cortex-app-server/src/lib.rs:133-145

No .layer(axum::middleware::from_fn(auth::auth_middleware)) or equivalent is applied, so every endpoint under /api/v1, websocket, streaming, share, and admin routes is accessible anonymously.

Impact

• Any caller can create/delete sessions.
• File operations, terminal sessions, sharing, and admin endpoints are exposed without authentication.
• This ignores configured CORTEX_API_KEY, CORTEX_JWT_SECRET, and auth.enabled = true settings.

Reproduction

1. Start server with auth enabled, e.g. CORTEX_API_KEY=something or JWT configured.
2. Call protected routes without Authorization:
   POST /api/v1/sessions
POST /api/v1/files/write
GET /admin/stats
3. Observe successful responses; no authentication challenge/401 is returned.

Expected

Requests should be rejected with 401/403 when auth is enabled and endpoint not in anonymous allowlist.

Suggested Fix

• Add an auth layer in router composition:
  • Router::new().layer(axum::middleware::from_fn_with_state(...)) or equivalent.
• Optionally add config-controlled bypass per endpoint for explicit anonymous paths.