security: authenticate and isolate the router management API

Summary

The router management listener needs a deny-by-default authentication, authorization, exposure, and audit boundary. Owner surfaces: src/semantic-router/pkg/apiserver/, src/semantic-router/pkg/extproc/router_learning_runtime.go, deploy/kserve/service.yaml, deploy/kubernetes/istio/service.yaml, and src/vllm-sr/cli/container_start.py.

Current behavior

Non-health management routes expose configuration and mutable router state without route-bound caller authorization. The listener can bind broadly, live configuration reads can include secret-bearing fields, and learning mutations accept caller-provided provenance without binding it to an owned routing event.

Expected behavior

Every non-health route is explicitly classified and authorized, protected exposure is intentional, secret values never leave the service, and learning mutations are attributable to an authenticated principal and owned decision.

Acceptance

• Maintain one route inventory containing method, permission, sensitivity, body policy, and audit action; deny any unregistered route.
• Bind local/default management access to loopback or another protected channel, and require an explicit deployment policy for remote exposure.
• Return a typed redacted configuration view; canary secrets are absent from responses, logs, and errors.
• Derive learning source from authenticated credentials and require an owned decision/event and model binding, idempotency, rate limits, and audit attribution.
• Enforce media types, request-size limits, request IDs, and immutable mutation audit events centrally.

Validation

• Add exhaustive anonymous and role-matrix tests for every registered route, including independent config, data, learning, and secret-view permissions.
• Run cd src/semantic-router && go test -race ./pkg/apiserver ./pkg/extproc.
• Run make agent-report ENV=cpu CHANGED_FILES=src/semantic-router/pkg/apiserver followed by the reported gates and affected E2E profiles.
• Add deployment checks proving the listener is not remotely exposed without its protection contract.

Related

• Parent audit: #2375
• Security index: #2357
• Config transactions: #2326
• Feedback provenance: #1452