[agora-fake-user] Browser UI cannot authenticate when AGORA_TOKEN is set

[kelos-bot]

Latest verdict

• Status: VALID
• Checked at: 2026-09-02T09:03:10Z
• Evidence: Local probe against http://127.0.0.1:18080 with AGORA_TOKEN=secret still returns 401 for unauthenticated GET /api/events?limit=1 and 200 with Authorization: Bearer secret; internal/server/static/app.js still sends only Content-Type in its shared fetch wrapper, so the browser UI cannot use the documented token-protected mode.