fix: code review fixes — auth gap, path traversal, dead code, health-check timeout

- backend/app.py: add Depends(_require_auth) to /api/copilotkit endpoint (critical
  security fix — endpoint was fully unprotected; now requires valid session cookie)
- backend/app.py: move 'from ag_ui.core import RunStartedEvent' from inline function
  body to top-level imports (style consistency)
- backend/auth.py: remove dead AUTH_PASS_HASH module-level constant (verify_password
  already reads from os.environ at call time; the cached binding was unused dead code)
- backend/artifacts.py: add path traversal guards to list_artifacts, get_artifact,
  and save_artifact — resolve paths and verify they stay within ARTIFACTS_DIR
- entrypoint.sh: health-check loop now sets READY flag and exits 1 if amplifierd
  fails to start within 30s (previously fell through silently, causing 502s)
- tests/test_app.py: add TestCopilotKitAuth — verifies unauthenticated requests to
  /api/copilotkit return 401; includes note explaining why streaming is not tested here
- tests/test_structure.sh: update to reflect that Dockerfile and entrypoint.sh now
  exist (created in Tasks 7+8); convert absent-checks to presence-checks

Co-authored-by: Amplifier <amplifier@anthropic.com>

backend/auth.py

@@ -5,9 +5,10 @@ import secrets
 
 import bcrypt
 
-# Module-level defaults (read from env at import time for AUTH_USER/AUTH_PASS_HASH)
+# AUTH_USER is read at import time (used by app.py to compare against the submitted email).
+# AUTH_PASS_HASH is intentionally NOT cached here — verify_password() reads it fresh from
+# os.environ at call time so runtime env changes (e.g. secret rotation) are respected.
 AUTH_USER: str = os.environ.get("AUTH_USER", "admin@localhost")
-AUTH_PASS_HASH: str = os.environ.get("AUTH_PASS_HASH", "")
 
 # In-memory session store: token -> email
 _sessions: dict[str, str] = {}