Local server security baseline (auth, limits, audit logs)

[Shreyas582]

Objective: secure localhost operation for professional use.

Scope:

• Bearer token auth and token rotation.
• Bind to 127.0.0.1 by default.
• Request size and rate limits.
• Audit logs for UI/API actions.

Acceptance criteria:

• Default server config is secure-by-default for local operation.

---

Dependency and Order

• Sequence slot: v1.0.0 step 2/4
• Blocked by: Implement local API server (wraithrun serve) with v1 endpoints #23
• Unblocks: Web UI MVP with live health panel and run triage #24
• Ready to start (dependencies met)

[Shreyas582]

Implemented in PR #90 (v1.0.0). Bearer auth, 127.0.0.1 bind, request body limits, rate limiting.