feat: add bearer token auth to API endpoints

[7174Andy]

Summary

Adds shared bearer token authentication to all machine-to-machine API endpoints on the allocator, preventing unauthorized access from the public internet. Implements the solution proposed in #280.

Changes

Added

• require_api_token decorator in main.py that validates Authorization: Bearer <token> headers using constant-time comparison (secrets.compare_digest)
• Auto-generated API token at allocator startup via secrets.token_urlsafe(32)
• Token passed to client VMs through Terraform → cloud-init → Docker env var (API_TOKEN)
• Bearer token headers added to all client service HTTP requests (subscribe.py, check_gpu.py, update_inuse_status.py)
• Bearer token headers added to cloud-init curl calls in user_data.sh (status updates, metrics)
• api_token Terraform variable (marked sensitive) plumbed through variables.tf → main.tf → user_data.sh
• 31 new parametrized auth tests covering: no token, wrong token, non-Bearer scheme, and /api/request_vm exemption

Changed

• All 99 existing allocator API tests updated to include bearer token headers
• Client tests updated to account for new headers parameter in HTTP calls

Protected Endpoints

Endpoint	Method	Auth
/vm_startup	POST	Bearer token
/api/unassigned_vms_count	GET	Bearer token
/api/update_inuse_status	POST	Bearer token
/api/gpu_health	POST	Bearer token
/api/vm-status	POST/GET	Bearer token
/api/vm-status/<hostname>	GET	Bearer token
/api/vm-logs	POST	Bearer token
/api/vm-logs/<hostname>	GET	Bearer token
/api/vm-metrics/<hostname>	POST	Bearer token
/api/request_vm	POST	None (student-facing)

Technical Details

• Token is auto-generated at each allocator startup — no configuration needed. Since client VMs are always destroyed before the allocator restarts (via terraform destroy), token persistence is unnecessary.
• Token is written to terraform.runtime.tfvars during /api/launch and passed to VMs via cloud-init environment variable.
• The require_api_token decorator uses secrets.compare_digest to prevent timing attacks.

Testing

• Allocator unit tests pass (306 passed)
• Client unit tests pass (50 passed)
• Linting passes (ruff check)

Related Issues

Closes #280
Related to #83

🤖 Generated with Claude Code