fix: Phase 1 - security & stability patches

- AuthMiddleware now requires auth on /v1/* routes (returns 401)
- WebSocket origin check configurable via WSAllowedOrigin
- Removed debug fmt.Printf leaks (config, ollama, server)
- Registry access protected by sync.RWMutex (race condition fix)
- Session cleanup goroutine runs every 15 min
- RevokeSession returns error instead of silent no-op

internal/middleware/auth.go

@@ -11,10 +11,14 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
-func AuthMiddleware(database *db.DB) gin.HandlerFunc {
+func AuthMiddleware(database *db.DB, requireAuth bool) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		authHeader := c.GetHeader("Authorization")
 		if authHeader == "" {
+			if requireAuth {
+				c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "missing authorization header"})
+				return
+			}
 			c.Next()
 			return
 		}