Update: drop the API-key requirement from the update trigger

Owner's call: MeterVault__AllowInAppUpdate is now the whole gate. One click on
the banner, no key, no prompt, and the REST endpoint no longer asks for one
either.

What that means, recorded so it is not rediscovered later: with the flag on,
anything that can reach MeterVault can trigger a rebuild and restart. On the
realistic threat model that is a repeatable denial of service — minutes of
downtime and a pegged CPU per request — rather than code injection, because the
build comes from the owner's own repository. It becomes remote code execution
if that repository is ever compromised. The flag still defaults off, and that
default is now the only thing between an upgrade and an open trigger, so
UpdateRunnerTests pins it along with the fact that configuring API keys does not
imply consent to rebuild the host.

Kept one guard, which is not authentication: the REST endpoint requires an
X-MeterVault-Update header. Without it any website could POST to the endpoint
through the browser of someone on the network — a plain HTML form is enough,
and no key means nothing else would stop it. A form cannot set a custom header
and a cross-origin fetch that tries is stopped by a preflight nothing here
answers, so this costs a deliberate caller one flag and costs the button
nothing, since it runs over the Blazor circuit rather than HTTP.

The confirmation dialog stays, now purely as a guard against a stray click
costing several minutes of downtime. Every triggered update is logged as a
warning: with no key there is no caller to attribute it to, and the restart
discards anything held in memory.

Claude-Session: https://claude.ai/code/session_01V6joyergfvVLFEizH1hJLd

src/App/Api/ApiEndpoints.cs

@@ -25,6 +25,9 @@ public static class ApiEndpoints
 {
     private const int MaxReadingsPerRequest = 5000;
 
+    /// <summary>Header confirming an update request was made on purpose rather than by a foreign page.</summary>
+    public const string UpdateRequestHeader = "X-MeterVault-Update";
+
     public static IEndpointRouteBuilder MapMeterVaultApi(this IEndpointRouteBuilder app)
     {
         var api = app.MapGroup("/api/v1").AddEndpointFilter<ApiKeyFilter>().WithTags("MeterVault");
@@ -59,9 +62,6 @@ public static class ApiEndpoints
             return Results.Ok(new IngestResult(written, updated, rejected, ignored));
         }).WithSummary("Ingest one or more readings (idempotent). Lets Home Assistant push.");
 
-        // Not on the shared group filter: that one lets requests through anonymously when
-        // AllowAnonymousApi is set, and opening reads must never open a root shell. This checks the
-        // presented key itself, in constant time, on top of the group filter.
         api.MapPost("/system/update", async (HttpContext http, UpdateRunner runner, CancellationToken ct) =>
         {
             if (runner.Availability is not UpdateAvailability.Allowed)
@@ -71,22 +71,25 @@ public static class ApiEndpoints
                     title: runner.Availability switch
                     {
                         UpdateAvailability.NotEnabled => "In-app update is disabled. Set MeterVault__AllowInAppUpdate=true.",
-                        UpdateAvailability.NoApiKeyConfigured => "In-app update requires at least one configured API key.",
                         _ => "This install has no in-place update mechanism (containers are replaced, not updated).",
                     });
             }
 
-            if (!runner.IsAuthorised(http.Request.Headers[ApiKeyFilter.HeaderName].ToString()))
+            // Not authentication — the operator opted out of that. This only stops a *different site*
+            // driving the endpoint through the browser of someone on this network: a plain HTML form
+            // cannot set a custom header, and a cross-origin fetch that tries is stopped by the
+            // preflight, which nothing here answers. Costs a deliberate caller one flag.
+            if (!http.Request.Headers.ContainsKey(UpdateRequestHeader))
             {
-                return Results.Problem(statusCode: StatusCodes.Status401Unauthorized,
-                    title: "A valid API key is required to start an update.");
+                return Results.Problem(statusCode: StatusCodes.Status400BadRequest,
+                    title: $"Send the {UpdateRequestHeader} header to confirm this is a deliberate request.");
             }
 
             var launch = await runner.LaunchAsync(ct);
             return launch.Started
                 ? Results.Accepted(value: new { message = launch.Message })
                 : Results.Problem(statusCode: StatusCodes.Status500InternalServerError, title: launch.Message);
-        }).WithSummary("Start an in-place update (LXC only; requires opt-in and a valid API key).");
+        }).WithSummary($"Start an in-place update (LXC only; requires MeterVault__AllowInAppUpdate and the {UpdateRequestHeader} header).");
 
         api.MapGet("/meters", async (MeterVaultDbContext db, CancellationToken ct) =>
             Results.Ok(await db.Meters.AsNoTracking()

src/App/Components/Shared/UpdateBanner.razor

@@ -3,6 +3,10 @@
 @inject UpdateRunner Runner
 @inject ISnackbar Snackbar
 
+@* No key prompt: the operator opted out of that (MeterVault__AllowInAppUpdate is the whole gate).
+   The confirmation stays — not as a security control, but because a stray click costs several
+   minutes of downtime while the rebuild runs. *@
+
 @* Renders nothing at all unless a newer release genuinely exists — no "you are up to date" noise. *@
 @if (_status is { UpdateAvailable: true, Running: { } running, Latest: { } latest })
 {
@@ -31,16 +35,10 @@
             This pulls the latest source, rebuilds it, and restarts the service. It takes a few minutes,
             during which MeterVault is unavailable. Readings are not affected — ingestion resumes on restart.
         </MudText>
-        @* The UI has no login, so the key is what actually authorises this — not the click. It is
-           typed each time rather than remembered, so a browser left open on this page is not a
-           standing permission to execute code on the host. *@
-        <MudTextField @bind-Value="_apiKey" Label="API key" InputType="InputType.Password" Immediate="true"
-                      HelperText="The key from MeterVault__ApiKeys — required because the web UI has no login." />
     </DialogContent>
     <DialogActions>
         <MudButton OnClick="@(() => _confirmOpen = false)" Disabled="_starting">Cancel</MudButton>
-        <MudButton Color="Color.Primary" Variant="Variant.Filled" OnClick="StartUpdateAsync"
-                   Disabled="@(_starting || string.IsNullOrWhiteSpace(_apiKey))">
+        <MudButton Color="Color.Primary" Variant="Variant.Filled" OnClick="StartUpdateAsync" Disabled="_starting">
             @(_starting ? "Starting…" : "Update now")
         </MudButton>
     </DialogActions>
@@ -51,7 +49,6 @@
     private string _command = "";
     private bool _confirmOpen;
     private bool _starting;
-    private string? _apiKey;
     private readonly DialogOptions _dialogOptions = new() { MaxWidth = MaxWidth.ExtraSmall, FullWidth = true };
 
     protected override void OnInitialized()
@@ -82,14 +79,6 @@
         _starting = true;
         try
         {
-            if (!Runner.IsAuthorised(_apiKey))
-            {
-                // Same message either way: whether a key is wrong or the deployment has none is not
-                // something an unauthenticated caller should be able to distinguish.
-                Snackbar.Add("That API key was not accepted.", Severity.Error);
-                return;
-            }
-
             var launch = await Runner.LaunchAsync();
             Snackbar.Add(launch.Message, launch.Started ? Severity.Success : Severity.Error);
             if (launch.Started)
@@ -99,8 +88,6 @@
         }
         finally
         {
-            // Never keep the key in component state: this circuit outlives the dialog.
-            _apiKey = null;
             _starting = false;
         }
     }