adds critical test coverage for RPC auth to prevent regressions:
- requests without Authorization header are rejected when auth enabled
- /api/v0/version always accessible per docs requirement
- users cannot use each other's secrets in multi-user setups
- empty AllowedPaths denies all access except version
- CLI commands require --api-auth flag when auth enabled
all tests pass (16/16)