buyer: single-operator password gate (BUYER_PASSWORD + signed session cookie)

Adds an Express requireAuth middleware on /v1/* + the SPA shell and a
Vite/React login screen so anyone who reaches mp-buyers.* must authenticate
before driving the operator's wallet via /v1/submit-prompt or /v1/accept.

Why: the buyer-app sits on a public HTTP port and signs txs with a
server-held private key. Until now the only gate was network reachability.

Mechanics:
- BUYER_PASSWORD + SESSION_SECRET (>=32 chars) loaded by config.ts and
  surfaced as createApp() deps. Production refuses to start without both.
- buyer/src/auth.ts: HMAC-SHA256 signed buyer_session cookie (HttpOnly,
  SameSite=Lax, Path=/, optional Secure), 7-day rolling expiry,
  timing-safe password compare, in-memory 5/15-min per-IP rate limiter.
- /v1/auth/{login,logout,whoami}. Login is rate-limited; 6th wrong
  attempt returns 429 + Retry-After. Success resets the bucket.
- SPA boot block (__BUYER_BOOT__ injected by server.ts) is gated by the
  same cookie so the buyer's address never reaches an unauthenticated
  browser.
- New <AuthProvider>/<RequireAuth> in buyer/src/ui/state/AuthContext.tsx
  probes /v1/auth/whoami on mount and a scoped window.fetch patch drops
  to the login screen on any mid-session 401 from /v1/* (excluding
  /v1/auth/* so wrong-password 401s stay local to <Login>).
- Tailwind login card at buyer/src/ui/pages/Login.tsx. App.tsx wraps in
  <RequireAuth> and adds a "Sign out" button in the nav.

Tests: tests/unit/buyer-server-auth.test.ts covers sign/verify, rate
limiter, cookie helpers, login flow (400/401/204/429), whoami
(no-cookie/valid/tampered/expired), rolling renewal, logout, gated
/v1/*, /healthz still open, and the no-auth-deps construction shape.
Updated buyer-server-config + buyer-ui-smoke for the new required env
vars and the AuthProvider wrap.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/unit/buyer-server-config.test.ts

@@ -19,6 +19,8 @@ describe("loadConfig(env)", () => {
     INDEXER_URL: "http://localhost:3001",
     BUYER_PORT: "3002",
     NETWORK_ID: "0",
+    BUYER_PASSWORD: "hunter2",
+    SESSION_SECRET: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
   };
 
   it("returns a BuyerConfig when all required env vars are present", () => {
@@ -27,6 +29,9 @@ describe("loadConfig(env)", () => {
     expect(config.indexerUrl).toBe(VALID_ENV.INDEXER_URL);
     expect(config.port).toBe(3002);
     expect(config.networkId).toBe(0);
+    expect(config.password).toBe(VALID_ENV.BUYER_PASSWORD);
+    expect(config.sessionSecret).toBe(VALID_ENV.SESSION_SECRET);
+    expect(config.cookieSecure).toBe(true);
   });
 
   it("throws when BUYER_PRIV_KEY_HEX is missing", () => {
@@ -54,6 +59,34 @@ describe("loadConfig(env)", () => {
     const config = loadConfig(env);
     expect(config.networkId).toBe(0);
   });
+
+  it("throws when BUYER_PASSWORD is missing", () => {
+    const env = { ...VALID_ENV };
+    delete (env as Record<string, string | undefined>).BUYER_PASSWORD;
+    expect(() => loadConfig(env)).toThrow(/BUYER_PASSWORD/);
+  });
+
+  it("throws when SESSION_SECRET is missing", () => {
+    const env = { ...VALID_ENV };
+    delete (env as Record<string, string | undefined>).SESSION_SECRET;
+    expect(() => loadConfig(env)).toThrow(/SESSION_SECRET/);
+  });
+
+  it("throws when SESSION_SECRET is shorter than 32 chars", () => {
+    const env = { ...VALID_ENV, SESSION_SECRET: "too-short" };
+    expect(() => loadConfig(env)).toThrow(/SESSION_SECRET/);
+  });
+
+  it('honours COOKIE_SECURE="0" for plain-HTTP loopback dev', () => {
+    const env = { ...VALID_ENV, COOKIE_SECURE: "0" };
+    const config = loadConfig(env);
+    expect(config.cookieSecure).toBe(false);
+  });
+
+  it("throws when COOKIE_SECURE is not 0 or 1", () => {
+    const env = { ...VALID_ENV, COOKIE_SECURE: "true" };
+    expect(() => loadConfig(env)).toThrow(/COOKIE_SECURE/);
+  });
 });
 
 // ─── createApp tests ──────────────────────────────────────────────────────────