feat(auth): owner-only middleware for single-user bearer auth

lib/auth/owner.js

@@ -0,0 +1,17 @@
+export function ownerOnly(req, res, next) {
+  const expected = process.env.OWNER_TOKEN;
+  if (!expected) {
+    return res.status(500).json({
+      error: { code: 'no_owner_token', message: 'OWNER_TOKEN not configured' }
+    });
+  }
+  const auth = req.headers.authorization || '';
+  const [scheme, token] = auth.split(' ');
+  if (scheme !== 'Bearer' || token !== expected) {
+    return res.status(401).json({
+      error: { code: 'unauthorized', message: 'invalid token' }
+    });
+  }
+  req.actor = { kind: 'user', id: null };
+  next();
+}