feat: authenticate Iris SSE subscription

[shivros]

Summary

• Adds optional sources.iris.api_token bearer authentication to the Iris SSE subscription.
• Materializes RITE_IRIS_API_TOKEN safely in Docker configuration and documents the deployment path.
• Validates blank tokens, warns when an enabled Iris source has no token, and tests header presence/absence.

Validation

• cargo build --all-targets
• cargo test --all-targets (15 tests)
• cargo clippy --all-targets -- -D warnings
• cargo fmt --all -- --check
• sh -n docker-entrypoint.sh
• git diff --check

The initial build attempt exhausted /tmp; the complete gates above passed with CARGO_TARGET_DIR=/home/shiv/vault/tmp/rite-COD-467-target.

[shivros]

🤖 Automated Review Panel

Reviewer A — gpt-5.6-terra

Initial findings: Docker TOML escaping, constructor compatibility, validation/reconnect coverage, and potential Debug token exposure.

Resolution: switched Docker token serialization to TOML literal strings with apostrophe escaping; restored IrisSource::new(base_url) and added new_with_token; validation and header-presence/absence coverage pass. The token is held only in reqwest sensitive headers and is not logged by current startup paths. Reconnects reuse the same configured client.

Reviewer B — Gemini 3 Flash

Initial findings: Docker token interpolation could truncate/corrupt quoted tokens; header test should be stronger.

Resolution: Docker literal-string serialization now preserves quotes/backslashes; the test covers configured and absent authorization headers. Full Rust gates were rerun after the fixes.

Result: no unresolved blocking correctness findings.

[shivros]

Auto-Merge Gate

Verdict: MERGE (squash) — confidence 0.88

Rationale: PR implements COD-467 deliverables 1–6 exactly: IrisConfig.api_token config field, IrisSource::new_with_token setting a sensitive Authorization: Bearer default header (reused on reconnects — same client), blank-token validation error + no-token warning (legacy unauthenticated Iris stays supported), Docker entrypoint materializing RITE_IRIS_API_TOKEN into the generated TOML using literal-string serialization with apostrophe escaping (reviewer-verified safe for quotes/backslashes), README + example TOML docs, and a header-presence/absence mock-SSE test covering both configured and unconfigured cases. Both reviewers' findings (TOML escaping, constructor compatibility, Debug token exposure, test strength) are resolved in the diff with the resolutions described in the panel comment.

Checks observed (all green): test (rite CI).

Independent local verification (disposable clone, TechGodHQ/rite @ d9d612f): cargo build --all-targets ✓ · cargo test --all-targets ✓ · cargo clippy --all-targets -- -D warnings ✓ · cargo fmt --all -- --check ✓. Branch was 1 commit behind main (PR #13, orthogonal http_post enrichment); merge-tree dry run shows no conflicts, confirmed by GitHub mergeStateStatus: CLEAN.

Acceptance criteria: cargo gates green ✓ · header test passes ✓ · Docker path verified via TOML-literal serialization + mock test (ticket explicitly allows mock-based verification, no live iris needed) ✓ · token never logged ✓ (sensitive header flag; not in startup paths).

Scope limits: Token is user-supplied deployment config, never a repo credential; no secrets touched. Ordering note: iris COD-429 implementation (iris#48) merged minutes before this, so the pairing ships consistently. Linked Linear COD-467 scanned for manual-review markers — none.