Add robust coverage for server/middleware/api-guard.ts

[anthuanvasquez]

Context

server/middleware/api-guard.ts now contains stricter origin and internal-secret validation, but there is no dedicated test coverage for this critical middleware.

Problem

Security behavior can regress silently without tests.

Proposed Solution

Create focused tests covering:

• valid x-internal-secret bypass
• reject missing origin/referer in production
• reject unauthorized origin
• reject invalid allowedOrigin config
• allow development bypass only when expected

Acceptance Criteria

• New test file for middleware behavior
• All critical branches covered
• Existing API tests remain green

Notes

This should run inside current Vitest setup and avoid flaky mocks where possible.