docs: document that auth is out of scope and /reauth renews the OSC token

[birme]

Documents, in code and in the readme, that intercom-manager deliberately ships no authentication layer of its own, and that GET /api/v1/reauth exists to renew the OSC issued token when the service runs behind the OSC auth wall.

Contributors keep reaching for an app level bearer auth on this endpoint, so the design intent is now recorded where it will be read. Authoritative statement from birme: #283 (comment)

Documentation only. No behaviour change, no route, schema, or dependency touched.

Changes

• src/api_re_auth.ts: block comment on the /reauth plugin explaining that auth is out of scope, that the OSC auth wall fronts the API in an OSC deployment, that this route only renews the externally issued token into the eyevinn-intercom-manager.sat cookie, and that adding an in-process auth layer conflicts with the auth wall and breaks current deploys and installations.
• src/api.ts: short comment at the registration site stating the missing auth hook is deliberate, pointing at the block comment.
• readme.md: new ## Authentication section between the environment variable table and Installation / Usage, saying the same for users and contributors, and noting that the existing WHIP_AUTH_KEY covers only the WHIP and WHEP ingest endpoints and is not a general API auth mechanism.

Every claim in the new text was read out of the code first: the api/v1 prefix, the eyevinn-intercom-manager.sat cookie name and its two hour maxAge, the POST /servicetoken call to the OSC token service with x-pat-jwt, and the 405 returned when OSC_ACCESS_TOKEN is unset.

Verification

• npx tsc --noEmit -p tsconfig.json clean
• npx prettier --check clean on the three changed files
• npx eslint src/api.ts src/api_re_auth.ts 0 errors (one pre-existing lastError unused warning, untouched)

Lessons

@fastify/helmet is declared in package.json but was missing from a stale local node_modules, so tsc --noEmit failed with a misleading TS2307 on an unrelated file; run npm ci before trusting a local typecheck in this repo. Also worth knowing for future work here: WHIP_AUTH_KEY is the only bearer key the backend checks, and it is scoped to WHIP and WHEP ingest only, so it is not precedent for adding bearer auth to other routes.

🤖 Generated with Claude Code

Co-Authored-By: Claude noreply@anthropic.com