fix(auth): harden unified diagnostic execution

backend/src/config.ts

@@ -27,6 +27,7 @@ export interface AppConfig {
   ollamaEnsureTimeoutMs: number;
   piManagementTimeoutMs: number;
   secretsFile?: string;
+  piAuthFile?: string;
   secretFiles: Readonly<Record<string, string | undefined>>;
   modelApiKeyFile?: string;
   /**
@@ -259,6 +260,11 @@ export function loadConfig(env: Record<string, string | undefined>): AppConfig {
     secretsFile.trim() !== secretsFile || secretsFile.length === 0 || secretsFile.includes("\0")
     || !path.isAbsolute(secretsFile)
   )) throw new Error("secret bundle configuration is invalid");
+  const piAuthFile = env.THT_PI_AUTH_FILE;
+  if (piAuthFile !== undefined && (
+    piAuthFile.trim() !== piAuthFile || piAuthFile.length === 0 || piAuthFile.includes("\0")
+    || !path.isAbsolute(piAuthFile)
+  )) throw new Error("Pi authentication source configuration is invalid");
   const secretFiles: Record<string, string | undefined> = {};
   for (const name of [
     "THT_MODEL_API_KEY_SECRET_FILE", "THT_DWH_API_KEY_SECRET_FILE", "THT_VEC_API_KEY_SECRET_FILE",
@@ -335,6 +341,7 @@ export function loadConfig(env: Record<string, string | undefined>): AppConfig {
     ollamaEnsureTimeoutMs: Number(env.OLLAMA_ENSURE_TIMEOUT_MS ?? 60000),
     piManagementTimeoutMs: piManagementTimeout(env.PI_MANAGEMENT_TIMEOUT_MS),
     secretsFile,
+    piAuthFile,
     secretFiles,
     modelApiKeyFile,
     dwhPrecheck: env.THT_DWH_PRECHECK === "true" || env.THT_DWH_PRECHECK === "1",