A repository-scoped token reads /api/v1/here, /api/v1/search and /api/v1/explore within its scope, instead of a 404 that anonymous does not get #6208

A crew run's token (the repository-scoped one) now reads /api/v1/here, /api/v1/search, /api/v1/explore and /api/v1/openapi.json inside its scope. Before, the run gate answered 404 to all four. The type check passes and the new test passes. I also ran the existing search, explore and here suites, which pass. I did not run the full bun test.

• Gate: src/http/run_gate.ts lets GET and HEAD through on those four exact paths. The handlers narrow what comes back to the token's own repository and its fork, exposed as runRepos. The fork parent stays readable only through /api/v1/repos/..., as before.
• here: it answers 200 only when the resolved page is one of those two repositories. Anything else is a plain 404, including /, /explore, /search, other repositories, and nonexistent ones. A repository outside the scope and one that doesn't exist get the same 404.
• search: it calls the new searchWithin in src/actions/search.ts. That searches only the two repositories, each still checked with canRead, and merges the results. Live origin search is switched off for these tokens.
• explore: rows are filtered to those whose repository is the token's own or its fork. Person and forge rows are dropped.
• openapi.json: it redirects (308 to /contract/openapi.json) as it does for anonymous.
• Test: in test/run-token.test.ts, a token scoped to gods-eye-view sits beside a second public repository (public) and a private one (vault). It checks that:

- here returns 200 for the two in-scope paths and 404 for six out-of-scope paths. - search and explore return only in-scope repositories, and the search checks cover repos, issues and code hits. - public and vault appear for the unscoped personal token, so their absence for the run token is meaningful.

I read "repository-scoped token" as the crew run token (auth.run) and gated only that. Ordinary ro/rw/admin tokens have no repository scope in this codebase. Plain tokens are not affected by any of this.

The /search?q= web page stays 404 for run tokens, as before.

I added no dependencies.

Closes #6200

A crew run's token (the repository-scoped one) now reads /api/v1/here, /api/v1/search, /api/v1/explore and /api/v1/openapi.json inside its scope. Before, the run gate answered 404 to all four. The type check passes and the new test passes. I also ran the existing search, explore and here suites, which pass. I did not run the full bun test.

• Gate: src/http/run_gate.ts lets GET and HEAD through on those four exact paths. The handlers narrow what comes back to the token's own repository and its fork, exposed as runRepos. The fork parent stays readable only through /api/v1/repos/..., as before.
• here: it answers 200 only when the resolved page is one of those two repositories. Anything else is a plain 404, including /, /explore, /search, other repositories, and nonexistent ones. A repository outside the scope and one that doesn't exist get the same 404.
• search: it calls the new searchWithin in src/actions/search.ts. That searches only the two repositories, each still checked with canRead, and merges the results. Live origin search is switched off for these tokens.
• explore: rows are filtered to those whose repository is the token's own or its fork. Person and forge rows are dropped.
• openapi.json: it redirects (308 to /contract/openapi.json) as it does for anonymous.
• Test: in test/run-token.test.ts, a token scoped to gods-eye-view sits beside a second public repository (public) and a private one (vault). It checks that:

- here returns 200 for the two in-scope paths and 404 for six out-of-scope paths. - search and explore return only in-scope repositories, and the search checks cover repos, issues and code hits. - public and vault appear for the unscoped personal token, so their absence for the run token is meaningful.

I read "repository-scoped token" as the crew run token (auth.run) and gated only that. Ordinary ro/rw/admin tokens have no repository scope in this codebase. Plain tokens are not affected by any of this.

The /search?q= web page stays 404 for run tokens, as before.

I added no dependencies.