feat(admin): add device credential isolation

admin/cmd/server/main.go

@@ -7,7 +7,7 @@ import (
 
 	"cmbuyer/admin/internal/auth"
 	"cmbuyer/admin/internal/config"
-	"cmbuyer/admin/internal/evidence"
+	"cmbuyer/admin/internal/deviceauth"
 	"cmbuyer/admin/internal/server"
 	evidencestorage "cmbuyer/admin/internal/storage/evidence"
 	"cmbuyer/admin/internal/storage/sqlite"
@@ -15,7 +15,9 @@ import (
 	"cmbuyer/admin/internal/tasks"
 )
 
-const listenAddress = ":8080"
+// Device Bearer credentials must not cross a plaintext LAN. The MVP is a same-computer
+// deployment, so widening this address requires a separately reviewed TLS boundary first.
+const listenAddress = "127.0.0.1:8080"
 
 func main() {
 	if err := run(); err != nil {
@@ -46,6 +48,10 @@ func run() error {
 	if err != nil {
 		return err
 	}
+	deviceAuthenticator, err := deviceauth.NewSQLiteAuthenticator(database)
+	if err != nil {
+		return err
+	}
 
 	router, err := server.NewRouter(server.Options{
 		AdminUsername:       configuration.AdminUsername,
@@ -54,7 +60,7 @@ func run() error {
 		Tasks:               taskStore,
 		TaskDetails:         detailStore,
 		Evidence:            evidenceStore,
-		DeviceAuthenticator: evidence.RejectAllDeviceAuthenticator{},
+		DeviceAuthenticator: deviceAuthenticator,
 	})
 	if err != nil {
 		return err

admin/cmd/server/main_test.go

@@ -0,0 +1,9 @@
+package main
+
+import "testing"
+
+func TestListenAddressIsIPv4LoopbackOnly(t *testing.T) {
+	if listenAddress != "127.0.0.1:8080" {
+		t.Fatalf("listenAddress = %q, want loopback-only endpoint", listenAddress)
+	}
+}