security: unauthenticated HTTP API endpoints expose database queries and index operations #1008

The FastAPI router in src/codegraphcontext/api/router.py exposes several management and query endpoints—including /index, /query (proxying to execute_cypher_query), and /tools/call—without any authentication middleware.

Anyone with network access to the API port can execute arbitrary Cypher queries (and bypass the regex blocklist), start arbitrary indexing jobs on the host, or call backend MCP tools, which presents a critical security risk.

Where it is:

• File: src/codegraphcontext/api/router.py
• Function/Section: All route definitions (e.g., /index, /query, /tools/call)

Why it matters:
An unauthenticated API allows arbitrary actors to execute Cypher queries against the database, trigger indexing jobs on the host, or call internal tools, leading to potential data exposure and unauthorized actions.

Steps to reproduce / observe:

1. Start the FastAPI server (e.g. running the visualizer or API).
2. Perform a POST request to http://localhost:<port>/api/v1/query with an empty or custom Cypher payload from a separate terminal without supplying any auth headers.
3. Observe that the API processes the request successfully.

Suggested direction:
Introduce an API key or Token-based authentication layer. Read a secure token from configuration (config.yaml or .env), validate it in a FastAPI dependency (e.g., checking the Authorization header), and return 401 Unauthorized for invalid or missing keys. We can auto-generate a secure token on first run if none is set.