fix: add fail-closed preHandler auth check

apps/api/src/index.ts

@@ -11,6 +11,15 @@ async function main() {
     timestamp: new Date().toISOString(),
   }));
 
+  server.addHook("preHandler", async (request, reply) => {
+    if (request.url === "/health") return;
+    const auth = request.headers.authorization;
+    if (!auth || !auth.startsWith("Bearer ")) {
+      await reply.code(401).send({ error: "Unauthorized" });
+      return;
+    }
+  });
+
   server.get("/", async () => ({
     name: "c0py",
     version: "0.1.0",