security: fix critical vulnerabilities (issues #2 and #3)

Issue #2: Unprotected Chat Summary Trigger (CRITICAL)
- Add authentication and admin authorization to /trigger endpoint
- Add path validation to prevent directory traversal
- Block access to system directories (/etc, /root, /sys, /proc, /boot)
- Add tests for unauthorized access and invalid paths

Issue #3: Exception Information Disclosure (HIGH)
- Replace raw exception messages with generic errors
- Log full exception details server-side with logger.exception()
- Affected files: auth.py, files.py, passkey.py, opc_agents.py
- Prevents information leakage about system architecture

Security Impact:
- Prevents unauthenticated file system writes
- Reduces reconnaissance opportunities for attackers
- Maintains security while preserving debugging capability

Tests: 214 passing, all security tests verified

dashboard/backend/routers/chat_summary.py

@@ -1,6 +1,9 @@
-import aiosqlite
-from fastapi import APIRouter, HTTPException
+import os
 
+import aiosqlite
+from fastapi import APIRouter, Depends, HTTPException
+
+import auth_service as auth
 from config import CHAT_SUMMARY_DB
 
 router = APIRouter()
@@ -38,10 +41,20 @@ async def get_messages(date: str):
 
 
 @router.post("/trigger")
-async def trigger_summary():
-    import os
+async def trigger_summary(current_user=Depends(auth.get_current_user)):
+    """Trigger chat summary generation. Admin only."""
+    if current_user.role != "admin":
+        raise HTTPException(status_code=403, detail="Admin access required")
 
     trigger_path = os.environ.get("CHAT_SUMMARY_TRIGGER", "/app/data/chat-summarizer/trigger")
+
+    # Validate path to prevent directory traversal to sensitive locations
+    trigger_path = os.path.abspath(trigger_path)
+    # Block access to system directories
+    forbidden_prefixes = ("/etc/", "/root/", "/sys/", "/proc/", "/boot/")
+    if any(trigger_path.startswith(prefix) for prefix in forbidden_prefixes):
+        raise HTTPException(status_code=400, detail="Invalid trigger path")
+
     os.makedirs(os.path.dirname(trigger_path), exist_ok=True)
     with open(trigger_path, "w") as f:
         f.write("1")