feat(e2e): guarded ephemeral test-account API for CI integration tests vs prod

POST/DELETE /internal/e2e/account — lets CI mint a real ephemeral test account
on prod per run, exercise integration flows, then reap. Security:
- X-E2E-Token constant-time guard; unset/wrong token → 404 (inert + no existence
  leak). Ships INERT (no E2E_ACCOUNT_TOKEN config = off by default).
- Create makes an is_test_cohort=true team+user (live worker skip-guards neuter
  billing/churn/email/quota), tier ≤ pro — team/growth rejected 400 (Team gated).
  Returns a JWT_SECRET-signed session JWT (no Brevo dependency).
- Reap ONLY deletes is_test_cohort teams — a real team → 403 not_test_cohort
  (the load-bearing safety test: TestE2EAccount_Reap_NonCohortTeam_Forbidden).
- Rate-limited (fail-open), audit-logged (e2e.account.created/reaped),
  metric instant_e2e_account_total{op,result}.

Foundation for running the real-backend integration suite against production
in CI with on-the-fly accounts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mastermanas805

dump.rdb

@@ -263,6 +263,29 @@ type Config struct {
 	// WORKER_INTERNAL_JWT_SECRET in BOTH the api and the worker
 	// (same value, generated via `openssl rand -hex 32`).
 	WorkerInternalJWTSecret string
+
+	// E2EAccountToken is the shared secret that guards the CI-only
+	// ephemeral-test-account surface (POST/DELETE /internal/e2e/account).
+	// CI mints real test-cohort accounts against PRODUCTION to run
+	// integration tests, then reaps them — that is the only thing this
+	// token authorizes.
+	//
+	// INERT BY DEFAULT (flag-protection): when this is empty, BOTH e2e
+	// routes return 404 for every request, hiding the endpoint's
+	// existence entirely. The endpoint cannot mint or reap a single
+	// account until an operator sets E2E_ACCOUNT_TOKEN — so the surface
+	// ships safe-by-default and is only "armed" in the environments
+	// (CI/prod) where the secret is wired. The caller authenticates by
+	// sending the exact value in the X-E2E-Token request header; the
+	// handler does a crypto/subtle constant-time compare and 404s on any
+	// mismatch (never 401/403 — a distinguishable status would leak that
+	// the route exists).
+	//
+	// Distinct secret from JWTSecret and WorkerInternalJWTSecret: this
+	// one authorizes account *creation/destruction*, a strictly more
+	// dangerous capability than session-signing, so it gets its own key
+	// and its own k8s Secret entry (generate via `openssl rand -hex 32`).
+	E2EAccountToken string
 }
 
 // ErrMissingConfig is returned when a required env var is absent.
@@ -427,6 +450,9 @@ func Load() *Config {
 	cfg.SendGridWebhookKey = os.Getenv("SENDGRID_WEBHOOK_PUBLIC_KEY")
 
 	cfg.WorkerInternalJWTSecret = strings.TrimSpace(os.Getenv("WORKER_INTERNAL_JWT_SECRET"))
+	// E2E_ACCOUNT_TOKEN: empty = the /internal/e2e/* surface is inert
+	// (every call 404s). See Config.E2EAccountToken for the full posture.
+	cfg.E2EAccountToken = strings.TrimSpace(os.Getenv("E2E_ACCOUNT_TOKEN"))
 	cfg.DeployDomain = getenv("DEPLOY_DOMAIN", "instant.dev")
 	cfg.ComputeProvider = getenv("COMPUTE_PROVIDER", "noop")
 	cfg.KubeNamespaceApps = getenv("KUBE_NAMESPACE_APPS", "instant-apps")

internal/config/config.go

@@ -68,6 +68,7 @@ func allKeys() []string {
 		"BREVO_WEBHOOK_SECRET", "SES_SNS_SUBSCRIPTION_ARN",
 		"SENDGRID_WEBHOOK_PUBLIC_KEY",
 		"WORKER_INTERNAL_JWT_SECRET", "ADMIN_PATH_PREFIX",
+		"E2E_ACCOUNT_TOKEN",
 	}
 }
 
@@ -196,6 +197,19 @@ func TestConfig_IsServiceEnabled(t *testing.T) {
 	}
 }
 
+func TestLoad_E2EAccountToken(t *testing.T) {
+	// Unset → empty (inert-by-default: the /internal/e2e/* surface 404s).
+	applyBaselineEnv(t, nil)
+	if got := Load().E2EAccountToken; got != "" {
+		t.Errorf("E2EAccountToken default: want empty (inert), got %q", got)
+	}
+	// Set (with surrounding whitespace) → trimmed value.
+	applyBaselineEnv(t, map[string]string{"E2E_ACCOUNT_TOKEN": "  secret-token  "})
+	if got := Load().E2EAccountToken; got != "secret-token" {
+		t.Errorf("E2EAccountToken: want trimmed 'secret-token', got %q", got)
+	}
+}
+
 func TestLoad_HappyPath_AppliesDefaults(t *testing.T) {
 	applyBaselineEnv(t, nil)
 	cfg := Load()