Fix harness forbidden error: use internal token instead of host check

The localhost check using host header and x-forwarded-for was unreliable
in the standalone Next.js server which may inject forwarded headers
internally. Replace with a per-process random token shared between the
PTY server and the API route via env var.

apps/harness/server.js

@@ -2,11 +2,16 @@ const { createServer } = require("http");
 const path = require("path");
 const { parse } = require("url");
 
+const crypto = require("crypto");
+
 const dev = process.env.NODE_ENV !== "production";
 // HOSTNAME in K8s is the pod name — always bind to 0.0.0.0
 const hostname = "0.0.0.0";
 const port = parseInt(process.env.PORT || "3100", 10);
 
+// Shared secret for internal PTY→API calls (generated per process)
+process.env.INTERNAL_API_TOKEN = crypto.randomBytes(32).toString("hex");
+
 // In production, load the standalone config to avoid webpack dependency
 if (!dev) {
   try {