Security: worker API and MCP transport trust any loopback process (unauthenticated read/write)

_Found via a CodeRabbit deep-scan, validated against current `main`. Part of a six-issue security batch (SEC-01)._ ## Summary The worker's HTTP API (`src/services/worker/http/middleware.ts`) and the MCP HTTP transport (`src/servers/mcp-http.ts`) treat **any loopback TCP peer as the owning OS user**. `SettingsRoutes` documents this directly ("POST /api/settings has no authentication — the worker trusts loopback"). On a multi-user host, shared VM, or CI worker, *any* local account — not just the owner — can: - **Read all memories** via `GET /api/observations`, `/api/search`, etc. - **Rewrite whitelisted settings** via `POST /api/settings`, including `CLAUDE_MEM_DATA_DIR` and `CLAUDE_MEM_WORKER_HOST`, which are both HTTP-writable today. - **Exfiltrate provider credentials**: `CLAUDE_MEM_OPENAI_COMPAT_BASE_URL` / `CLAUDE_MEM_OPENROUTER_BASE_URL` are HTTP-writable while the API keys are file-only — repointing the base URL sends `Authorization: Bearer ` plus observer content to an attacker endpoint on the next completion. - **Arbitrary file read**: the MCP HTTP transport accepts `X-Claude-Mem-Cwd: /any/absolute/dir`, and `smart_unfold` then reads files under it with the owner's permissions. - **Arbitrary file overwrite**: repoint `CLAUDE_MEM_DATA_DIR` to an attacker-controlled dir, plant `supervisor.json` as a symlink, and `writeJsonFileAtomic` (which deliberately resolves destination links) overwrites any owner-writable file. - **Reinstall footgun**: `openclaw/install.sh`'s settings merge preserves only keys listed in `defaults` (`key in defaults`), so a reinstall drops `CLAUDE_MEM_TV_TOKEN` while keeping `CLAUDE_MEM_WORKER_HOST=0.0.0.0` — silently turning a token-gated remote listener into an unauthenticated remote API. ## Suggested fix Owner-scoped bearer token generated at ` /worker-auth-token` (mode `0600`) required on `/api/*` + `/stream` for loopback callers — health/readiness, the spool-ingest bearer and `/api/auth/*` exempt — with the same token on the MCP HTTP transport; `CLAUDE_MEM_DATA_DIR`/`CLAUDE_MEM_WORKER_HOST` removed from the HTTP-writable whitelist; `install.sh` preserving every existing settings key.