[security] Require authentication for localhost API clients when auto-attach can affect privileged USB state

[PatrickQuintal]

Summary

The API skips authentication for localhost clients by default, while auto-attach is enabled by default and can invoke USB/IP attach behavior.

Relevant code:

• internal/server/api/config.go:7-10 defaults the API listener to :3242, auto-attach to true, and localhost auth to false.
• internal/server/api/server.go:322-326 only requires auth for localhost when RequireLocalHostAuth is set.
• internal/cmd/server.go:98-105 registers bus/device management and stream routes.
• internal/server/api/handler/bus_device_add.go:90-99 auto-attaches added devices.
• internal/server/api/autoattach_linux.go:20-28 invokes the usbip attach command.

Impact

If VIIPER runs as an installed service or otherwise has privileges/USB permissions that ordinary local processes do not have, any local process can create virtual devices, request auto-attach, and stream input reports without knowing the API password. For a project whose purpose is exposing virtual controllers/keyboards/mice, this is a meaningful local integrity boundary.

Suggested fix

• Require API auth for localhost by default in installed/service mode.
• Make unauthenticated localhost access an explicit development mode.
• Consider Unix domain sockets/named pipes with OS ACLs for trusted local UI access.
• Gate auto-attach behind authentication/authorization and device ownership checks.