fix: 支持 AgentRun render-only REST 入口 (#170)

Co-authored-by: AgentRun Codex <agentrun-codex@users.noreply.github.com>

src/selftest/cases/10-manager-memory.ts

@@ -18,13 +18,36 @@ const selfTest: SelfTestCase = async () => {
     assert.equal(((health.runnerWorkReady as { valuesPrinted?: unknown } | undefined)?.valuesPrinted), false);
     assert.ok((((health.runnerWorkReady as { requiredImageTools?: string[] } | undefined)?.requiredImageTools) ?? []).includes("npm"));
     assert.equal(health.secretRefs?.valuesPrinted, false);
+    await assertManagerAuthBoundary();
     await assertLongResultUsesTerminalAssistant(client, store);
-    return { name: "manager-memory", tests: ["manager-memory-lifecycle", "manager-result-long-trace"] };
+    return { name: "manager-memory", tests: ["manager-memory-lifecycle", "manager-auth-boundary", "manager-result-long-trace"] };
   } finally {
     await new Promise<void>((resolve) => server.server.close(() => resolve()));
   }
 };
 
+async function assertManagerAuthBoundary(): Promise<void> {
+  const store = new MemoryAgentRunStore();
+  const server = await startManagerServer({ port: 0, host: "127.0.0.1", sourceCommit: "self-test", store, auth: { apiKey: "self-test-secret", source: "self-test" } });
+  try {
+    const healthResponse = await fetch(new URL("/health/readiness", server.baseUrl));
+    assert.equal(healthResponse.status, 200);
+    const healthEnvelope = await healthResponse.json() as JsonRecord;
+    assert.equal(healthEnvelope.ok, true);
+    const deniedResponse = await fetch(new URL("/api/v1/queue/tasks", server.baseUrl));
+    assert.equal(deniedResponse.status, 401);
+    const deniedEnvelope = await deniedResponse.json() as JsonRecord;
+    assert.equal(deniedEnvelope.ok, false);
+    assert.equal(deniedEnvelope.failureKind, "auth-failed");
+    assert.equal((deniedEnvelope.message as string).includes("Bearer"), true);
+    const client = new ManagerClient(server.baseUrl, { apiKey: "self-test-secret" });
+    const page = await client.get("/api/v1/queue/tasks") as JsonRecord;
+    assert.equal(Array.isArray(page.items), true);
+  } finally {
+    await new Promise<void>((resolve) => server.server.close(() => resolve()));
+  }
+}
+
 async function assertLongResultUsesTerminalAssistant(client: ManagerClient, store: MemoryAgentRunStore): Promise<void> {
   const run = store.createRun({
     tenantId: "unidesk",