[agora-fake-user] Browser UI cannot authenticate when AGORA_TOKEN is set

[kelos-bot]

Latest verdict

• Status: VALID
• Checked at: 2026-08-26T09:02:36Z
• Evidence: internal/server/server.go:48-55 requires auth for every /api/* request when AGORA_TOKEN is set, but internal/server/static/app.js:51-73 issues /api/events, /api/threads, and /api/agents/${actor}/inbox fetches without any auth header. I reproduced it locally: GET / returned 200, GET /api/events?limit=1 returned 401 without auth, and the same request returned 200 with Authorization: Bearer secret.