fix(security): JWT require env, remove *** token, WS auth disabled

fix(automation): implement all 6 actions + real cron parser
fix(db): pq.Array for TEXT[], add sqlmock tests
fix(schema): single source migrations
docs: v2 architecture + frontend refactor proposals

backend/middleware/auth.go

@@ -19,11 +19,12 @@ func Auth(cfg *config.Config) func(http.Handler) http.Handler {
 				return
 			}
 
-			tokenString := strings.TrimPrefix(authHeader, "Bearer ")
-			if tokenString == authHeader {
+			// Only accept "Bearer <token>" format (RFC 6750)
+			if !strings.HasPrefix(authHeader, "Bearer ") {
 				writeError(w, http.StatusUnauthorized, "invalid authorization header")
 				return
 			}
+			tokenString := strings.TrimPrefix(authHeader, "Bearer ")
 
 			token, err := jwt.ParseWithClaims(tokenString, &handlers.Claims{}, func(token *jwt.Token) (interface{}, error) {
 				return []byte(cfg.JWTSecret), nil