sprint1: agent queue worker, proxy support, auto-mark-on-navigate-away, test fixes

backend/main.py

@@ -1,7 +1,9 @@
 import os
 import json
 import logging
-from fastapi import FastAPI, BackgroundTasks, Depends, HTTPException, Query
+from fastapi import FastAPI, BackgroundTasks, Depends, HTTPException, Query, Response
+from fastapi import Request
+from fastapi.responses import JSONResponse
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.staticfiles import StaticFiles
 from pydantic import BaseModel
@@ -11,6 +13,7 @@ import aiosqlite
 from db import init_db, get_db
 from fetcher import fetch_subscriptions
 from summarizer import summarize_video, summarize_all_pending
+from agent_worker import start_worker
 
 logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
 log = logging.getLogger(__name__)
@@ -23,8 +26,25 @@ app.add_middleware(
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
+
 )
 
+# API token validation for write operations
+API_TOKEN=os.environ.get('API_TOKEN', '')
+
+async def validate_api_token(request: Request, call_next):
+    path = request.url.path
+    method = request.method
+    # Only check auth for write operations on /api/*
+    if path.startswith("/api/") and method in ("POST", "PATCH", "DELETE") and API_TOKEN:
+        auth_header = request.headers.get("Authorization", "")
+        if not auth_header.startswith("Bearer ") or auth_header[7:] != API_TOKEN:
+            return JSONResponse(status_code=401, content={"detail": "Unauthorized"})
+    return await call_next(request)
+
+app.middleware("http")(validate_api_token)
+
+
 class StatusUpdate(BaseModel):
     status: str
 
@@ -45,11 +65,21 @@ class AgentQueueUpdate(BaseModel):
 @app.on_event("startup")
 async def startup():
     await init_db()
+    if os.environ.get("AGENT_ENABLED", "").lower() == "true":
+        await start_worker()
+        log.info("Agent queue worker enabled")
+    else:
+        log.info("Agent queue worker disabled (set AGENT_ENABLED=true to enable)")
 
 @app.get("/api/health")
 async def health():
     return {"status": "ok"}
 
+@app.get("/api/config")
+async def api_config():
+    """Return API config without exposing the token."""
+    return {"auth_enabled": bool(API_TOKEN)}
+
 @app.get("/auto_categories.json")
 async def auto_categories():
     path = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "frontend", "src", "auto_categories.json")