Every API endpoint is unauthenticated while CORS runs with `allow_credentials=True`

[olong75]

There is no authentication dependency anywhere in the backend. app/main.py mounts five routers plus the FAROS router with no Depends(...) guard, and the CORS policy explicitly allows credentialed cross-origin requests:

app.add_middleware(
    CORSMiddleware,
    allow_origins=_default_origins + _dev_origins,
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

backend/app/main.py:61

Origins are also extensible at deploy time through DEV_ALLOWED_ORIGINS (backend/app/main.py:49), which is a plain comma split with no validation — a single misconfigured deploy value silently widens the trust boundary.

Trigger: any browser on an allowed origin (or anyone at all on the network, since there is no auth at all) issues POST /api/v1/code/jobs followed by POST /api/v1/code/jobs/{id}/start.
Observed: the command runs as the backend user (see backend/app/code/run/job_runner.py:415), with no identity attached to the job row.
Expected: at minimum a shared-secret/token dependency on the routers that create jobs, mutate provider credentials, or delete projects, and origins that are an explicit allowlist rather than a free-form env split.

This is the root issue that makes several of the other reports in this batch remotely exploitable rather than local-only. If FAROS is intended to be a single-user localhost tool, please say so in the README and bind to 127.0.0.1 explicitly — right now nothing in the code communicates that assumption.