Found while checking the production proxy path. BearerAuthMiddleware falls
OPEN when admin.routes.session_manager is None and no CODERAI_API_TOKEN is
set: with no user database to check a token against it lets the request
through rather than locking out an install with no auth configured. That is
defensible on a loopback workstation.

main.py and build_system_app() both initialise that database. A bare
`uvicorn codai.api.app:app` start — exactly how the GPU-less orchestrator
runs — did not, so once published through a reverse proxy every /v1/* call
was served WITHOUT credentials. Verified before and after: session_manager
None on import, /v1/models 200 with no header; now initialised at import
and 401 for no header, a wrong Bearer, and nginx's Basic.

The readiness probes stay open on purpose (/healthz, /health, /v1/health):
a probe behind auth is read as "backend down" by every health checker,
surya-ocr's vLLM client included.

The guide gains the three traps of that deployment: auth_basic and Bearer
share one header so the API path must not be basic-authed, proxy_buffering
must be off for streaming, and how to check in one curl whether tokens are
actually enforced.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>