Isolate internal bot-config route from the public listener (#33)

The GET /internal/bot-config route returns the DECRYPTED Discord bot
token and was mounted on the same Express app / port 3000 that Pangolin
proxies publicly. Its only guard was the BOT_INTERNAL_KEY shared secret,
and .env.example shipped a placeholder default — so a forwarded path or a
weak/unrotated key would expose the plaintext token to the internet.

Move server<->bot internal traffic onto its own listener and fail fast on
a weak key:

- Add server/src/internalApp.js: a standalone Express app mounting
  requireInternalKey + /internal (and a no-secret /health), mirroring the
  bot's unpublished port-4100 pattern.
- server.js starts a second listener on INTERNAL_PORT (default 3001),
  closed on graceful shutdown.
- Remove the /internal mount from the public v1.router; the public app now
  404s /api/v1/internal/bot-config even with a valid key.
- Fail fast: new utils/botInternalKey.js rejects an empty, placeholder, or
  <16-char BOT_INTERNAL_KEY — fatal in production (exit 1), warning in dev.
- docker-compose: bot SITE_INTERNAL_URL -> app:3001/internal/bot-config;
  document that INTERNAL_PORT stays unpublished.
- .env.example (root/server/bot): document INTERNAL_PORT, the fail-fast
  behavior, and a defense-in-depth Pangolin deny rule for /api/v1/internal.

Tests: add requireInternalKey.test.js and botInternalKey.test.js
(node --test: 93 pass).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV

server/test/requireInternalKey.test.js

@@ -0,0 +1,66 @@
+const { test } = require('node:test')
+const assert = require('node:assert/strict')
+
+const requireInternalKey = require('../src/middleware/requireInternalKey')
+const { startApp } = require('./_helper')
+
+const KEY = 'test-internal-key-1234567890'
+
+async function withApp(run) {
+  const prev = process.env.BOT_INTERNAL_KEY
+  process.env.BOT_INTERNAL_KEY = KEY
+  const app = await startApp((a) => {
+    a.get('/internal/thing', requireInternalKey, (req, res) => res.json({ ok: true }))
+  })
+  try {
+    await run(app)
+  } finally {
+    await app.close()
+    if (prev === undefined) delete process.env.BOT_INTERNAL_KEY
+    else process.env.BOT_INTERNAL_KEY = prev
+  }
+}
+
+test('requireInternalKey: 401 when no key header is sent', async () => {
+  await withApp(async (app) => {
+    const res = await fetch(`${app.url}/internal/thing`)
+    assert.equal(res.status, 401)
+  })
+})
+
+test('requireInternalKey: 401 on a wrong key', async () => {
+  await withApp(async (app) => {
+    const res = await fetch(`${app.url}/internal/thing`, {
+      headers: { 'X-Internal-Key': 'nope' },
+    })
+    assert.equal(res.status, 401)
+  })
+})
+
+test('requireInternalKey: 200 with the correct key', async () => {
+  await withApp(async (app) => {
+    const res = await fetch(`${app.url}/internal/thing`, {
+      headers: { 'X-Internal-Key': KEY },
+    })
+    assert.equal(res.status, 200)
+    const body = await res.json()
+    assert.deepEqual(body, { ok: true })
+  })
+})
+
+test('requireInternalKey: 401 when the expected key is empty (never a wildcard)', async () => {
+  const prev = process.env.BOT_INTERNAL_KEY
+  process.env.BOT_INTERNAL_KEY = ''
+  const app = await startApp((a) => {
+    a.get('/internal/thing', requireInternalKey, (req, res) => res.json({ ok: true }))
+  })
+  try {
+    // Even sending an empty key must not match an empty expected key.
+    const res = await fetch(`${app.url}/internal/thing`, { headers: { 'X-Internal-Key': '' } })
+    assert.equal(res.status, 401)
+  } finally {
+    await app.close()
+    if (prev === undefined) delete process.env.BOT_INTERNAL_KEY
+    else process.env.BOT_INTERNAL_KEY = prev
+  }
+})