fix(ingestion): close the PR #152 review findings on REST auth

- main.go's wiring was untested (the test built its own copy of the
  router, so dropping auth in main or re-registering POST /query as
  public stayed green). Routing is now one function, buildMux, which
  main calls and the tests call: it constructs the bearer middleware
  itself, registers public handlers only for patterns on a fixed
  allowlist (a public REST pattern would beat the authenticated
  catch-all by specificity), refuses an empty token, and returns an
  http.Handler so nothing can add a route to the result.
- hyperguild CLI: PassRate sent no token and would 401. Every request
  now goes through brainClient.do, which adds it; the test covers
  Query, Write and PassRate and is named for that.
- ResolveIngestPath returns one refusal for every bad path; the raw
  EvalSymlinks error let a caller probe which server files exist and
  leaked the brain directory.
- PROJECT.md (and derived adapters) and the pass-rate runbook state
  that the REST API needs BRAIN_MCP_TOKEN and is tailnet/in-cluster.

Refs #149

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/internal/api/ingestpath_root.go

@@ -2,13 +2,14 @@ package api
 
 import (
 	"errors"
-	"fmt"
 	"path/filepath"
 	"strings"
 )
 
-// ErrOutsideIngestRoot means an ingest path does not resolve inside brain/raw/.
-var ErrOutsideIngestRoot = errors.New("ingest path must be inside brain/raw/")
+// ErrOutsideIngestRoot is the one refusal for every bad ingest path. It never
+// carries the underlying error: "no such file" versus "permission denied"
+// would let a caller probe which server files exist (PR #152 review).
+var ErrOutsideIngestRoot = errors.New("ingest path must be an existing file or directory inside brain/raw/")
 
 // ResolveIngestPath confines a caller-supplied ingest path to brain/raw/, the
 // inbox the watcher already owns (hyperguild#149). Relative paths resolve
@@ -16,18 +17,18 @@ var ErrOutsideIngestRoot = errors.New("ingest path must be inside brain/raw/")
 // a link inside raw/ that points elsewhere is refused. The path must exist.
 func ResolveIngestPath(brainDir, p string) (string, error) {
 	if strings.TrimSpace(p) == "" {
-		return "", fmt.Errorf("%w: path is empty", ErrOutsideIngestRoot)
+		return "", ErrOutsideIngestRoot
 	}
 	root, err := filepath.EvalSymlinks(filepath.Join(brainDir, "raw"))
 	if err != nil {
-		return "", fmt.Errorf("%w: inbox unavailable: %v", ErrOutsideIngestRoot, err)
+		return "", ErrOutsideIngestRoot
 	}
 	if !filepath.IsAbs(p) {
 		p = filepath.Join(root, p)
 	}
 	real, err := filepath.EvalSymlinks(filepath.Clean(p))
 	if err != nil {
-		return "", fmt.Errorf("%w: %v", ErrOutsideIngestRoot, err)
+		return "", ErrOutsideIngestRoot
 	}
 	rel, err := filepath.Rel(root, real)
 	if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || filepath.IsAbs(rel) {