fix(t115 🔴🔴🔴 三修): kbdb 認證完全 fail-closed——沒金鑰一律 401（含讀取）

leo 實證的洞＝「知道網址即可讀走全部知識」；一修 fail-open（沒設 secret 就不擋）、
二修仍放行讀取＝洞沒補。三修（總管手改）：無 token→全部 401（health 豁免），
老實例升級路徑＝重跑安裝器（同時注入金鑰與新 workflow），不以繼續外洩換相容。
＋結構閘測試：斷言 src/index.ts 的無 token 分支不得有 return next()——
擋「測試複本與真實作漂移」那類假綠（本輪正是它抓到二修的複本沒同步）。
kbdb vitest 60/60 全綠（總管親跑）。

kbdb/wrangler.toml

@@ -15,6 +15,20 @@ database_id = "0c580910-e00b-4f8e-9c57-ac54ea52242f"  # 官方 prod D1（arcrun-
 [vars]
 ENVIRONMENT = "production"
 
+# ── Auth guard (t115 二修, fail-closed) ────────────────────────────────────────
+# The installer generates a random token at deploy time and secrets it into BOTH workers:
+#   wrangler secret put KBDB_INTERNAL_TOKEN   (arcrun-kbdb)
+#   wrangler secret put KBDB_INTERNAL_TOKEN   (arcrun-cypher-executor)
+# cypher sends the token as `Authorization: Bearer <token>` via kbdbBase().
+# Workflow http_request nodes that hit KBDB directly must include
+#   `Authorization: Bearer __KBDB_TOKEN__`  (installer substitutes the value).
+#
+# Secret NOT set → writes (POST/PATCH/DELETE) are rejected 401 immediately (fail-closed).
+#   Reads (GET) pass with a server-side warning — old instances survive the upgrade
+#   window until both workers receive the secret at the same time.
+# Secret SET     → all non-health routes require correct Bearer; / and /health exempt.
+# ──────────────────────────────────────────────────────────────────────────────
+
 # ── Optional embed module (issue #7 / SDD T2.4) ────────────────────────────────
 # Base 預設不開（free-tier 友善）。self-host 開語義查詢時，deploy.ts 偵測 config kbdb_embed:true
 # → 取消下面兩段註解（注入 active binding）並 `wrangler vectorize create arcrun-kbdb-embed