feat(jarvis-node): bearer-token auth + Windows/macOS/Linux install

[Mikecranesync]

Summary

Closes the Jarvis Node auth gap (unauthenticated /shell RCE) and makes the node easy to deploy across the fleet — including the Windows PLC/travel laptops.

Auth (jarvis_node.py)

• Every data-bearing endpoint requires Authorization: Bearer <JARVIS_TOKEN>, compared with secrets.compare_digest (timing-safe).
• Fail-closed: if JARVIS_TOKEN is unset, protected endpoints return 503 ("refuse to run unauthenticated").
• / and /health stay public — healthcheck endpoints that should respond without auth.
• Auth is enforced as ASGI middleware (covers every route, including ones a future dev forgets to decorate) rather than a per-route Depends.

Client (workers/jarvis_node_client.py)

• Reads JARVIS_TOKEN from the environment and attaches the bearer header to every request.

Install / deploy (remoteme-jarvis-node/)

• install.bat — Windows quick-start (PLC laptop, travel laptop): installs deps, generates a token if unset, detects Tailscale IP, runs foreground.
• install.sh — macOS/Linux foreground quick-start.
• install-node.sh + run-node.sh — always-on service (launchd/systemd), tailnet-only bind, Doppler fail-closed token.
• requirements.txt, README.md (security notes, fleet topology, endpoint table, verify steps).

Test evidence

fastapi.testclient smoke test — all 8 cases pass:

State	Request	Result
token unset	/health	200 ✅
token unset	/	200 ✅
token unset	/system-info	503 ✅
token set	/ (no auth)	200 ✅
token set	/health	200 ✅
token set	/system-info (no auth)	401 ✅
token set	/system-info (bad token)	401 ✅
token set	/system-info (good token)	200 ✅

Notes / out of scope

• The client has pre-existing endpoint drift (/file/read vs server's /files/read; /click//type//interpret don't exist server-side). Left alone — unrelated to auth.
• The RegisterData VFD fix and other working-tree changes on fix/plc-registerdata-vfd-fields were deliberately not included.

🤖 Generated with Claude Code