chore(auth): v3.4 batch — 4 nit cleanup + drop JWT-era 410 stubs

Picks up 4 of the v3.3.6 §7 follow-up nit list + removes 2 leftover
JWT-era compatibility stubs. All in octo-server, no cross-repo
coupling. Strict scope per caster's principle: no compat for
nonexistent clients post-Phase 4.

## Changes (5 items, all runtime-branch-exclusive surfaces)

### nit-3 — botToken empty Bearer guard (bot_provision/bot_api.go)
Empty Bearer guard after TrimPrefix. Behavior alignment (early reject)
with verify-api-key's empty-field guard — robustness/symmetry, not
client compatibility.

### nit-6 — Remove unreachable botUID == "" dead code (bot_provision/bot_api.go)
gin's :uid param cannot be empty after the route matches; the guard
was carried over from the legacy JWT handler.

### nit-10 — Delete redundant deps_test.go (user/)
zz_external_setup_test.go's internal blank-import is a strict superset
of deps_test.go's 4-module subset. Updated zz header with supersedes
note. runtime-branch-only — main keeps deps_test.go (no zz on main).

### nit-11 — Fix stale test header (user/api_verify_apikey_test.go)
"6 cases" → 15 cases enumeration.

### Drop JWT-era 410 Gone stubs (bot_provision/bot_api.go)
Removed `r.GET("/.well-known/jwks.json", gone410Handler(...))` +
`r.POST("/v1/auth/token", gone410Handler(...))` + the
`gone410Handler` helper + 2 `TestGone410_*` test cases.

These stubs were registered to give pre-Phase 4 JWT-era daemon clients
a 410 + migration body instead of gin's default 404. But JWT was
removed in Phase 4 (决策一+二) and no real client ever ran the
pre-removal version (PoC-only). Compat scaffolding for nonexistent
clients — dropping it per caster's principle. gin default 404 on
unregistered URLs is functionally equivalent for the actually-zero
caller population.

Same reasoning as why nit-4 (JWT-shaped Bearer in-handler hint) was
also dropped — both branches assumed a JWT-era caller that doesn't
exist.

## Impact on main branch — 0

All 5 changes touch runtime-branch-exclusive surfaces:
- bot_provision/ module: does not exist on main
- /v1/auth/verify-api-key test: runtime-branch-only
- zz_external_setup_test.go: runtime-branch-only; deleting deps_test.go
  on runtime branch leaves main's deps_test.go untouched
- 410 stubs were registered by bot_provision which doesn't exist on main

## Verification
- `go build ./...` PASS
- `go vet ./modules/user/... ./modules/bot_provision/...` PASS
- `go test -count=1 -p 1 -run 'TestAuthVerify|TestBotToken|TestGone410'
  ./modules/user/... ./modules/bot_provision/...` PASS (user 3.8s,
  bot_provision 2.0s — TestGone410_* skipped since deleted)
- `go test -race -count=1 -p 1 -run 'TestAuthVerify|TestBotToken'
  ./modules/user/... ./modules/bot_provision/...` PASS (user 7.0s,
  bot_provision 3.6s)
- 4 TestDestroyApply_* failures observed during full-package runs are
  pre-existing flaky (verified on clean origin/feat/agent-runtime
  without this PR) — redis login-locked state leaks across tests.

## State-space scan (D1-D13)
- D1 primitive call-site coverage: not applicable — no SQL changes
- D4 response shape: no changes
- D5 cross-PR contract: no changes
- D11 revocation chain: explicitly NOT extended. Bot retention after
  owner ban remains per main branch semantic.

## Out of scope

- nit-5 owned_bots shape unify (cross-repo D10)
- nit-7 constant-time api_key compare (SQL semantic change)
- nit-8 account-ban gate on owned-bot loaders (reverted; preserves main
  semantic)
- nit-9 robot composite index (separate migration PR)
- verifyCache sha256-ize redis key (security polish)
- nit-4 JWT-shaped Bearer in-handler hint (reverted; same reasoning as
  410 stub removal — no real JWT-era client)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: caster-Q

modules/bot_provision/bot_api.go

@@ -27,7 +27,6 @@ import (
 	"github.com/Mininglamp-OSS/octo-lib/pkg/wkhttp"
 	"github.com/Mininglamp-OSS/octo-server/modules/botfather"
 	octoredis "github.com/Mininglamp-OSS/octo-server/pkg/redis"
-	"github.com/gin-gonic/gin"
 	rd "github.com/go-redis/redis"
 	"go.uber.org/zap"
 )
@@ -115,16 +114,16 @@ func (a *BotProvision) botToken(c *wkhttp.Context) {
 		return
 	}
 	apiKey := strings.TrimPrefix(auth, "Bearer ")
+	if apiKey == "" {
+		c.ResponseErrorWithStatus(errors.New("empty Bearer token"), http.StatusUnauthorized)
+		return
+	}
 	callerUID, callerSpace, err := a.resolveAPIKey(apiKey)
 	if err != nil {
 		c.ResponseErrorWithStatus(errors.New("invalid api_key"), http.StatusUnauthorized)
 		return
 	}
 	botUID := c.Param("uid")
-	if botUID == "" {
-		c.ResponseError(errors.New("uid required"))
-		return
-	}
 	type row struct {
 		BotToken   string `db:"bot_token"`
 		CreatorUID string `db:"creator_uid"`
@@ -187,17 +186,11 @@ var readRand = defaultReadRand
 var hexEncode = defaultHexEncode
 
 // Route mounts the two bot endpoints. JWT exchange + JWKS endpoints have
-// been removed (合并 plan 决策一+二 Phase 4) — daemon/web now hit
-// fleet/matter directly with api_key/session tokens.
+// been removed in Phase 4 — daemon/web now hit fleet/matter directly with
+// api_key/session tokens.
 //
 //	POST /v1/bot/mint        — web session auth (octo-lib session middleware)
 //	GET  /v1/bot/:uid/token  — daemon api_key Bearer (validated inline)
-//
-// Also registers 410 Gone stubs for removed legacy auth endpoints so old
-// callers get a deterministic deprecation signal instead of a 404 from an
-// unregistered path. The previous JWT/JWKS pair lived under these paths
-// and was dropped in 决策一+二 Phase 4; the stubs document the change for
-// any straggler client that hasn't been updated.
 func (a *BotProvision) Route(r *wkhttp.WKHttp) {
 	authGroup := r.Group("/v1", a.ctx.AuthMiddleware(r))
 	authGroup.POST("/bot/mint", a.mintBot)
@@ -220,44 +213,4 @@ func (a *BotProvision) Route(r *wkhttp.WKHttp) {
 	}))
 	verifyLimit := r.StrictIPRateLimitMiddleware(rlCtx, rlRedis, "verify", 1000.0/60, 100)
 	r.GET("/v1/bot/:uid/token", verifyLimit, a.botToken)
-
-	// Removed legacy auth endpoints (决策一+二 Phase 4). 410 Gone so a
-	// straggler client distinguishes "endpoint was removed by design" from
-	// "wrong URL / typo". Each stub returns a stable JSON body pointing at
-	// the replacement path so client owners can fix in place.
-	//
-	// v3.3.2 (Jerry-Xin R4 nit, caster local review): Sunset/Deprecation
-	// headers dropped. v3.3.1 hardcoded both dates wrong — Sunset said
-	// "Fri, 13 Jun 2026" but that day is actually Saturday; Deprecation
-	// said "@1749427200" which resolves to 2025-06-09, off by a year.
-	// Fixing the dates would just invite the next off-by-one when push
-	// slips. There's no deploy-pipeline substitution mechanism in this
-	// repo to keep them current, and zero current consumers depend on
-	// either header. The 410 status + structured JSON body remain — that
-	// is the actionable signal for both humans and automated clients.
-	// If we ever want Sunset back, deploy-time substitution must land
-	// first (separate PR).
-	r.GET("/.well-known/jwks.json", gone410Handler(
-		"JWKS endpoint removed — fleet/matter no longer verify JWTs locally. "+
-			"Use POST /v1/auth/verify (session) or /v1/auth/verify-api-key (daemon) instead.",
-	))
-	r.POST("/v1/auth/token", gone410Handler(
-		"Token exchange endpoint removed — daemon no longer exchanges api_key for a JWT. "+
-			"Send api_key directly as Authorization: Bearer to fleet/matter; they will "+
-			"call /v1/auth/verify-api-key for validation.",
-	))
-}
-
-// gone410Handler returns a wkhttp handler that always responds with HTTP 410
-// Gone + a structured JSON body describing why the endpoint was removed and
-// where to migrate. Sunset/Deprecation headers were considered (RFC 8594 /
-// draft-ietf-httpapi-deprecation) but dropped in v3.3.2 — see Route()
-// comment above for the reasoning.
-func gone410Handler(reason string) func(*wkhttp.Context) {
-	return func(c *wkhttp.Context) {
-		c.AbortWithStatusJSON(http.StatusGone, gin.H{
-			"error":   "gone",
-			"message": reason,
-		})
-	}
 }

modules/bot_provision/bot_api_test.go

@@ -251,56 +251,6 @@ func TestBotToken_DisabledSpace_401(t *testing.T) {
 		"api_key bound to a disabled space (s.status=0) must 401 even on daemon path — v3.3.3 §E")
 }
 
-// ─────────────────────────────────────────────────────────────────────
-// 410 Gone stubs (v3.3.2 reduced to status + body only — Sunset/Deprecation
-// headers dropped, see bot_api.go Route() comment). The v3.3.1 hardcoded
-// dates were both wrong (Sunset said Fri but the date is Saturday;
-// Deprecation @1749427200 resolves to 2025-06-09 not 2026), and there is
-// no deploy-pipeline substitution to keep them fresh. Body still carries
-// the actionable migration pointer.
-// ─────────────────────────────────────────────────────────────────────
-
-func doRaw(t *testing.T, s *server.Server, method, path string) *httptest.ResponseRecorder {
-	t.Helper()
-	w := httptest.NewRecorder()
-	req, err := http.NewRequest(method, path, nil)
-	require.NoError(t, err)
-	s.GetRoute().ServeHTTP(w, req)
-	return w
-}
-
-func TestGone410_JWKS_ReturnsStatusAndBody(t *testing.T) {
-	s, _ := testutil.NewTestServer()
-	w := doRaw(t, s, "GET", "/.well-known/jwks.json")
-
-	require.Equal(t, http.StatusGone, w.Code, "JWKS endpoint must respond 410")
-
-	// v3.3.2: Sunset/Deprecation headers dropped — assert they are NOT
-	// emitted. Locks the no-header decision in place so a future
-	// "let's re-add Sunset" change has to update this test, and at that
-	// point reviewer can confirm the constants are actually correct.
-	assert.Empty(t, w.Header().Get("Sunset"), "Sunset header must NOT be set (v3.3.2 drop)")
-	assert.Empty(t, w.Header().Get("Deprecation"), "Deprecation header must NOT be set (v3.3.2 drop)")
-
-	body := w.Body.String()
-	assert.Contains(t, body, "JWKS endpoint removed", "body must explain why + where to migrate")
-	assert.Contains(t, body, "verify-api-key", "body must point at the replacement endpoint")
-}
-
-func TestGone410_TokenExchange_ReturnsStatusAndBody(t *testing.T) {
-	s, _ := testutil.NewTestServer()
-	w := doRaw(t, s, "POST", "/v1/auth/token")
-
-	require.Equal(t, http.StatusGone, w.Code, "token exchange endpoint must respond 410")
-
-	assert.Empty(t, w.Header().Get("Sunset"), "Sunset header must NOT be set (v3.3.2 drop)")
-	assert.Empty(t, w.Header().Get("Deprecation"), "Deprecation header must NOT be set (v3.3.2 drop)")
-
-	body := w.Body.String()
-	assert.Contains(t, body, "Token exchange endpoint removed")
-	assert.Contains(t, body, "Authorization: Bearer")
-}
-
 // v3.3.6 §P1 regression — yujiawei R2 P1: account ban MUST revoke
 // botToken (daemon api_key path). resolveAPIKey → assertSpaceMember,
 // which now joins `user` ON u.status=1. mintBot is NOT separately

modules/user/api_verify_apikey_test.go

@@ -16,8 +16,12 @@ import (
 )
 
 // authVerifyAPIKey: POST /v1/auth/verify-api-key
-// 合并 plan §3 covers 6 cases: valid / unknown / owner-left-space /
-// legacy-empty-space / missing-field / multi-space.
+// 15 test cases covering: valid / unknown / owner-left-space /
+// non-active-membership / legacy-empty-space / disabled-space /
+// missing-field / multi-space / no-include (default shape) /
+// with-include (owned_bots map) / owned-bots only-in-bound-space /
+// owned-bots empty / owned-bots filters-disabled-bot /
+// account-banned (v3.3.6 §P1) / include-context DB-error fail-secure.
 
 const (
 	testAPIKeySpaceA = "verify_apikey_space_a"

modules/user/deps_test.go

@@ -18,6 +18,12 @@
 // `user` test set; adding a second would conflict ("multiple definitions
 // of TestMain"). A bare blank-import in any test file is enough to
 // trigger init() at test binary load.
+//
+// Supersedes the deprecated deps_test.go (removed in v3.4 cleanup): that
+// file only blank-imported a 4-module subset (base/botfather/group/robot)
+// which is a strict subset of what `internal` already pulls. Keeping
+// both was redundant — this single file fully covers the migration
+// registry requirement.
 package user_test
 
 import (