fix(deploy): close container final review

backend/src/config.ts

@@ -1,6 +1,6 @@
 export interface AppConfig {
   host: string; port: number; harnessDir: string; thtBin: string; piBin: string;
-  authMode: "none" | "mock" | "oidc";
+  authMode: "none" | "mock" | "upstream";
   defaults: { provider?: string; model?: string; thinking?: string };
   maxPiProcesses: number;
   settingsFile: string;
@@ -8,13 +8,20 @@ export interface AppConfig {
   ollamaEnsureTimeoutMs: number;
 }
 export function loadConfig(env: Record<string, string | undefined>): AppConfig {
+  const authMode = env.AUTH_MODE ?? "none";
+  if (!(["none", "mock", "upstream"] as const).includes(authMode as AppConfig["authMode"])) {
+    throw new Error(`unsupported AUTH_MODE=${authMode}; use none, mock, or upstream`);
+  }
+  if (env.THOTH_PUBLIC_EXPOSURE === "true" && authMode !== "upstream") {
+    throw new Error("public exposure requires AUTH_MODE=upstream behind a trusted proxy");
+  }
   return {
     host: env.HOST ?? "127.0.0.1",
     port: Number(env.PORT ?? 8787),
     harnessDir: env.THT_HARNESS_DIR ?? "../harness",
     thtBin: env.THT_BIN ?? "tht",
     piBin: env.PI_BIN ?? "pi",
-    authMode: (env.AUTH_MODE as AppConfig["authMode"]) ?? "none",
+    authMode: authMode as AppConfig["authMode"],
     defaults: { provider: env.PI_PROVIDER, model: env.PI_MODEL, thinking: env.PI_THINKING },
     maxPiProcesses: Number(env.MAX_PI_PROCESSES ?? 4),
     settingsFile: env.SETTINGS_FILE ?? "data/settings.json",