sched: SECURITY — закрыть /mcp и / (morda) без токена; auth-гвард на входе (кроме /api/health + static UI)

host-stacks/vds-kzntsv/sched-custom/Dockerfile.custom

@@ -1,9 +1,10 @@
 # sched custom single-binary — embedded engine + admin API + UI morda + MCP + storage (MariaDB).
 # Built on published @schedjs/* npm packages (artifacts that passed the gates).
-# Runs apps/daemon/src/custom-entry.mjs — one HTTP server :8080 routing /api, /mcp, / (morda).
+# Runs custom-entry.mjs — one HTTP server :8080 routing /api, /mcp, / (morda).
+# Auth at the boundary: everything EXCEPT /api/health + static UI assets requires Bearer SCHED_ADMIN_KEY.
 #
-# Build:
-#   docker build -f apps/daemon/Dockerfile.custom -t registry.kzntsv.site/sched-custom:0.12.1-mysql apps/daemon
+# Build (context = this dir):
+#   docker build -f host-stacks/vds-kzntsv/sched-custom/Dockerfile.custom -t registry.kzntsv.site/sched-custom:0.12.1-mysql host-stacks/vds-kzntsv/sched-custom
 # Run:
 #   docker run -e MYSQL_URL=mysql://sched:pw@mariadb:3306/sched?ssl={"rejectUnauthorized":false} \
 #             -e SCHED_ADMIN_KEY=... -e SCHED_TASKS=/app/config/tasks.json \
@@ -21,7 +22,7 @@ RUN echo '{"name":"schedd","private":true,"packageManager":"yarn@4.18.0"}' > pac
  && yarn cache clean
 
 ENV PATH="/app/node_modules/.bin:${PATH}"
-COPY src/custom-entry.mjs /app/custom-entry.mjs
+COPY custom-entry.mjs /app/custom-entry.mjs
 # Default tasks.json baked into the image (overridden on prod by a bind mount / SCHED_TASKS).
 RUN echo '{"tasks":[]}' > /app/tasks.json
 EXPOSE 8080