Fix harness forbidden error: use internal token instead of host check

The localhost check using host header and x-forwarded-for was unreliable
in the standalone Next.js server which may inject forwarded headers
internally. Replace with a per-process random token shared between the
PTY server and the API route via env var.

apps/harness/src/app/api/agents/[id]/env/route.ts

@@ -6,13 +6,9 @@ export async function GET(
   _request: NextRequest,
   { params }: { params: Promise<{ id: string }> },
 ) {
-  // Only allow localhost access
-  const forwarded = _request.headers.get("x-forwarded-for");
-  const host = _request.headers.get("host") ?? "";
-  const isLocal =
-    !forwarded &&
-    (host.startsWith("localhost") || host.startsWith("127.0.0.1"));
-  if (!isLocal) {
+  // Only allow internal calls from the PTY server (same process)
+  const token = _request.headers.get("x-internal-token");
+  if (!token || token !== process.env.INTERNAL_API_TOKEN) {
     return NextResponse.json({ error: "forbidden" }, { status: 403 });
   }