fix(p0): secure agent revocation and R6 worker queue

tests/unit/test_api_stream_auth_p0bc.py

@@ -52,12 +52,12 @@ class TestImageEndpointNotPublic:
         mod = _reload_api_stream()
         assert "/health" in mod._PUBLIC_PATHS
 
-    def test_replay_next_still_public(self, monkeypatch):
-        """/replay/next reste public (legacy agent Rust polling)."""
+    def test_replay_next_removed_from_public_paths(self, monkeypatch):
+        """/replay/next distribue des actions et exige desormais un Bearer."""
         monkeypatch.setenv("RPA_API_TOKEN", "deadbeef" * 4)
         monkeypatch.delenv("RPA_AUTH_DISABLED", raising=False)
         mod = _reload_api_stream()
-        assert "/api/v1/traces/stream/replay/next" in mod._PUBLIC_PATHS
+        assert "/api/v1/traces/stream/replay/next" not in mod._PUBLIC_PATHS
 
 
 # ---------------------------------------------------------------------------
@@ -157,6 +157,23 @@ class TestFailClosedTokenP0C:
             asyncio.get_event_loop().run_until_complete(mod._verify_token(req))
         assert exc_info.value.status_code == 401
 
+    def test_verify_token_rejects_replay_next_without_bearer(self, monkeypatch):
+        """P0 révocation : GET /replay/next n'est plus public."""
+        import asyncio
+        from unittest.mock import MagicMock
+        from fastapi import HTTPException
+
+        monkeypatch.setenv("RPA_API_TOKEN", "validtoken" * 4)
+        monkeypatch.delenv("RPA_AUTH_DISABLED", raising=False)
+        mod = _reload_api_stream()
+
+        req = MagicMock()
+        req.url.path = "/api/v1/traces/stream/replay/next"
+        req.headers = {}
+        with pytest.raises(HTTPException) as exc_info:
+            asyncio.get_event_loop().run_until_complete(mod._verify_token(req))
+        assert exc_info.value.status_code == 401
+
 
 @pytest.fixture(autouse=True)
 def _cleanup(monkeypatch):