Self-host the edge with AUTH_MODE=none

[danperks]

Summary

Run the production edge Worker on your own machine — local workerd via wrangler dev, Durable Object and R2 state on a Docker volume, no Cloudflare account, no WorkOS — and have every device pointed at it share one workspace.

docker compose -f docker-compose.selfhost.yml up --build
ZERON_EDGE_URL=http://localhost:8787 ZERON_WORKOS_CLIENT_ID= zeron headless

ZERON_EDGE_URL already existed "for local dev / self-hosting"; this fills in the rest so it is actually a self-host story rather than a dev-mode one.

Edge

• A third AUTH_MODE, none: no bearer is checked, every caller is the fixed identity from SELFHOST_USER_ID / SELFHOST_ORG_ID (default local/local). /health advertises userId/orgId so clients adopt it without any out-of-band user@org coordination.
• none is open to whoever can reach the port. docs/SELFHOST.md says so plainly and tells people to keep it on a private network or behind their own auth.
• Packaging: edge/Dockerfile, docker-compose.selfhost.yml (volume-backed, healthcheck), edge/wrangler.selfhost.jsonc (bindings and migrations mirror wrangler.jsonc, with a note to keep them in lockstep), npm run dev:selfhost.
• edge/src/auth.test.ts covers mode normalisation, identity defaults/overrides, and that none authenticates with or without a bearer while dev still requires one.

Engine

• Auth::detect (previously only used by tests) now understands auth: "none": drops WorkOS, takes the edge's userId/orgId as the user@org dev bearer, and flags the config as an open edge.
• resolve_profile prefers that org for the development profile, and assemble_runtime enables Edge rooms/relays for an open edge even with no ZERON_EDGE_TOKEN.
• build_auth probes only when WorkOS is off and ZERON_EDGE_URL is set. A dev boot that names no edge still makes zero network requests — local_first::development_without_an_explicit_bearer_stays_offline is unchanged and passing. A clean WorkOS boot is untouched.
• Two new tests in engine/tests/auth.rs: identity adoption from a none edge (overriding a configured dev bearer), and an unreachable edge leaving the configured dev identity alone.

Verification

• npm test in edge/ (unit + workerd), cargo test -p zeron-engine all green.
• End to end against both npm run dev:selfhost and the compose image: engine logs auth: edge is open (AUTH_MODE=none), registry room joins under org=local, device-room host connects, profile lands in orgs/local/local. Compose healthcheck goes healthy.

Not in this PR

A locked-down self-host mode (device tokens + QR pairing for phones) is a separate feature and will follow once this lands. Release mirroring for zeron update against a self-hosted edge is documented as unsupported for now.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}