AUTH4D-4 runtime boundary

Runtime endpoints

The fixed feature route factories reserve the OAuth, tenant identity, device authorization, and management paths described in docs/architecture/security-contracts.md. Authentication routes return a no-store OAuth error while their feature tickets remain unimplemented. Management routes use the structured management error envelope.

Every response receives a server-generated X-Request-Id and baseline browser security headers. Authentication and hosted-login responses use Cache-Control: no-store. JSON mutations require application/json, except OAuth token, revocation, and device authorization form submissions, which require application/x-www-form-urlencoded. Bodies are capped at the shared 65,536-byte contract limit and JSON is parsed at the HTTP boundary.

Management CORS is limited to the configured console origin. Authentication route CORS allows the configured canonical origins and optional comma-separated CLIENT_ORIGINS; production tenant client origin policy will be enforced by its owning feature. Issuer URLs are formed only from the configured AUTH_ORIGIN, never from request host headers.

RUNTIME_ENV must be set to local, staging, or production. Only production trusts Cloudflare’s CF-Connecting-IP; staging ignores forwarded address headers, and local mode uses the fixed loopback address for deterministic tests.