fix(push): enforce per-stream push authentication (S-8); remove webhook egress guard; triage remaining findings

[ntt0601zcoder]

What

Closes out the security triage: fixes the one remaining real gap (S-8) and removes a guard that blocked a legitimate use case; the rest of the open MEDIUM/LOW findings are risk-accepted with rationale in the audit doc.

S-8 — push ingest now authenticated (the fix)

Push ingest previously accepted any client that knew a registered stream code — the per-stream StreamKey was in the data model but never checked.

• RTMP publishers supply the secret as ?key=<secret> on the publish URL; the query is stripped from the stream name, so routing is unaffected.
• The RTMP server resolves a stream's configured StreamKey via a resolver (publisher in-memory table for live + auto-publish runtime streams, with a store+template fallback for configured streams — mirroring the media-auth PolicyResolver) and constant-time-compares it before claiming the registry slot. A mismatch is rejected before any slot/pipeline state changes.
• An empty StreamKey opts the stream out (unauthenticated, backward-compatible).
• Auto-publish enforces the matching template's StreamKey inside ResolveOrCreate before materialising the runtime stream, so an unauthorised push never starts a pipeline.

Operational note: after deploy, any stream with a configured stream_key will require encoders to push with ?key=…; streams without a key are unaffected.

Webhook egress guard removed

The internal/netguard dial guard on the webhook client (and the package) is removed: webhooks legitimately target private/local endpoints (sidecar collectors, internal services on loopback), the admin API that made it reachable is now authenticated, and delivery is blind POST — so the guard blocked a real use case for negligible benefit.

Triage (audit doc)

• S-8 → fixed.
• S-6 (webhook SSRF), S-7/S-9/S-10/S-11 (MEDIUM), S-12/S-14/S-15/S-16 (LOW) → risk-accepted, each with rationale.

Tests

TestPushKeyOK, TestPushSecretFromQuery, TestResolveOrCreate_StreamKeyEnforced. make check green (build + vet + lint 0 issues + test -race, 31 packages).

Residual (noted, not in scope)

Concurrent-runtime-stream cap + per-source-IP rate-limit (DoS hardening, orthogonal to the auth gap); SRT push has no server in the codebase so there is nothing to gate there.