fix(runtime): force requireAuth on ObjectOS multi-tenant host

Auto-enable based on tierEnabled('auth') only triggers when the host
stack declares the auth tier. On ObjectOS the auth tier lives inside
each per-project artifact (via AuthProxyPlugin), so the host stack's
tier list is empty and requireAuth defaulted to false — leaving
anonymous /api/v1/data/* open on CF (reproduced live at crm.objectos.app).

Force api.requireAuth: true in createObjectOSStack so anonymous data
access on the host returns 401 regardless of how individual project
artifacts declare auth. Also bumps wrangler image tag.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: hotlong

apps/objectos/wrangler.toml

@@ -44,7 +44,7 @@ compatibility_flags = ["nodejs_compat"]
 # rebuild + re-push to ship a new version, then run `wrangler deploy`.
 [[containers]]
 class_name = "ObjectOSContainer"
-image = "registry.cloudflare.com/2846eb40a60f4738e292b90dcd8cce10/objectos:95c95d09"
+image = "registry.cloudflare.com/2846eb40a60f4738e292b90dcd8cce10/objectos:7dcde27c"
 max_instances = 5
 instance_type = "standard-1"
 

packages/runtime/src/cloud/objectos-stack.ts

@@ -66,7 +66,7 @@ export interface ObjectOSStackConfig {
 
 export interface ObjectOSStackResult {
     plugins: any[];
-    api: { enableProjectScoping: true; projectResolution: 'auto' };
+    api: { enableProjectScoping: true; projectResolution: 'auto'; requireAuth: true };
 }
 
 /**
@@ -237,6 +237,12 @@ export async function createObjectOSStack(config: ObjectOSStackConfig): Promise<
         api: {
             enableProjectScoping: true,
             projectResolution: 'auto',
+            // ObjectOS is multi-tenant: anonymous /api/v1/data/* must never
+            // leak per-project data across organisations. AuthProxyPlugin
+            // verifies upstream tokens and populates ctx.userId; requireAuth
+            // turns missing userId into 401 at the REST layer before the
+            // request reaches the per-project kernel.
+            requireAuth: true,
         },
     };
 }