Isolate internal bot-config route from the public listener (#33)

The GET /internal/bot-config route returns the DECRYPTED Discord bot
token and was mounted on the same Express app / port 3000 that Pangolin
proxies publicly. Its only guard was the BOT_INTERNAL_KEY shared secret,
and .env.example shipped a placeholder default — so a forwarded path or a
weak/unrotated key would expose the plaintext token to the internet.

Move server<->bot internal traffic onto its own listener and fail fast on
a weak key:

- Add server/src/internalApp.js: a standalone Express app mounting
  requireInternalKey + /internal (and a no-secret /health), mirroring the
  bot's unpublished port-4100 pattern.
- server.js starts a second listener on INTERNAL_PORT (default 3001),
  closed on graceful shutdown.
- Remove the /internal mount from the public v1.router; the public app now
  404s /api/v1/internal/bot-config even with a valid key.
- Fail fast: new utils/botInternalKey.js rejects an empty, placeholder, or
  <16-char BOT_INTERNAL_KEY — fatal in production (exit 1), warning in dev.
- docker-compose: bot SITE_INTERNAL_URL -> app:3001/internal/bot-config;
  document that INTERNAL_PORT stays unpublished.
- .env.example (root/server/bot): document INTERNAL_PORT, the fail-fast
  behavior, and a defense-in-depth Pangolin deny rule for /api/v1/internal.

Tests: add requireInternalKey.test.js and botInternalKey.test.js
(node --test: 93 pass).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV

server/test/botInternalKey.test.js

@@ -0,0 +1,55 @@
+const { test } = require('node:test')
+const assert = require('node:assert/strict')
+
+const { evaluateBotInternalKey, MIN_LENGTH } = require('../src/utils/botInternalKey')
+
+const STRONG = 'x'.repeat(MIN_LENGTH + 8)
+
+test('a strong key is ok in every environment', () => {
+  for (const nodeEnv of ['production', 'development', undefined]) {
+    const r = evaluateBotInternalKey({ key: STRONG, nodeEnv })
+    assert.equal(r.ok, true)
+    assert.equal(r.fatal, false)
+    assert.equal(r.message, null)
+  }
+})
+
+test('empty key is fatal in production, warn otherwise', () => {
+  const prod = evaluateBotInternalKey({ key: '', nodeEnv: 'production' })
+  assert.equal(prod.ok, false)
+  assert.equal(prod.fatal, true)
+
+  const dev = evaluateBotInternalKey({ key: '', nodeEnv: 'development' })
+  assert.equal(dev.ok, false)
+  assert.equal(dev.fatal, false)
+})
+
+test('undefined key behaves like empty', () => {
+  const r = evaluateBotInternalKey({ key: undefined, nodeEnv: 'production' })
+  assert.equal(r.ok, false)
+  assert.equal(r.fatal, true)
+})
+
+test('documented placeholders are rejected (fatal in production)', () => {
+  for (const key of ['change-me-to-a-long-random-string', 'dev-only-change-me-bot-key']) {
+    const r = evaluateBotInternalKey({ key, nodeEnv: 'production' })
+    assert.equal(r.ok, false, `placeholder should be rejected: ${key}`)
+    assert.equal(r.fatal, true)
+  }
+})
+
+test('a too-short key is rejected', () => {
+  const short = 'a'.repeat(MIN_LENGTH - 1)
+  const r = evaluateBotInternalKey({ key: short, nodeEnv: 'production' })
+  assert.equal(r.ok, false)
+  assert.equal(r.fatal, true)
+
+  const dev = evaluateBotInternalKey({ key: short, nodeEnv: 'development' })
+  assert.equal(dev.ok, false)
+  assert.equal(dev.fatal, false)
+})
+
+test('a key exactly MIN_LENGTH long is accepted', () => {
+  const r = evaluateBotInternalKey({ key: 'a'.repeat(MIN_LENGTH), nodeEnv: 'production' })
+  assert.equal(r.ok, true)
+})