fix: code review fixes — auth gap, path traversal, dead code, health-check timeout

- backend/app.py: add Depends(_require_auth) to /api/copilotkit endpoint (critical
  security fix — endpoint was fully unprotected; now requires valid session cookie)
- backend/app.py: move 'from ag_ui.core import RunStartedEvent' from inline function
  body to top-level imports (style consistency)
- backend/auth.py: remove dead AUTH_PASS_HASH module-level constant (verify_password
  already reads from os.environ at call time; the cached binding was unused dead code)
- backend/artifacts.py: add path traversal guards to list_artifacts, get_artifact,
  and save_artifact — resolve paths and verify they stay within ARTIFACTS_DIR
- entrypoint.sh: health-check loop now sets READY flag and exits 1 if amplifierd
  fails to start within 30s (previously fell through silently, causing 502s)
- tests/test_app.py: add TestCopilotKitAuth — verifies unauthenticated requests to
  /api/copilotkit return 401; includes note explaining why streaming is not tested here
- tests/test_structure.sh: update to reflect that Dockerfile and entrypoint.sh now
  exist (created in Tasks 7+8); convert absent-checks to presence-checks

Co-authored-by: Amplifier <amplifier@anthropic.com>

entrypoint.sh

@@ -26,13 +26,19 @@ amplifierd --port 8410 --bundle /app/bundle/bundle.md &
 AMPLIFIERD_PID=$!
 
 echo "Waiting for amplifierd..."
+READY=0
 for i in $(seq 1 30); do
     if curl -s http://localhost:8410/health > /dev/null 2>&1; then
         echo "[OK] amplifierd on :8410"
+        READY=1
         break
     fi
     sleep 1
 done
+if [ "$READY" -eq 0 ]; then
+    echo "[ERROR] amplifierd failed to start within 30s — aborting" >&2
+    exit 1
+fi
 
 # (5) Start FastAPI backend
 cd /app/backend