fix: resolve staging blockers B1-B5, S6, X5 (quality review v1)

agent_platform/api.py

@@ -60,13 +60,19 @@ class AgentUpdate(BaseModel):
 
 
 class ChatMessage(BaseModel):
-    message: str = Field(..., min_length=1)
+    message: str = Field(..., min_length=1, max_length=32000)
 
 
 # === App ===
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
+    # B1 Boot Guard: refuse to start with default or weak AUTH_TOKEN
+    if settings.AUTH_TOKEN == "change-me-in-production" or len(settings.AUTH_TOKEN) < 32:
+        raise RuntimeError(
+            "AUTH_TOKEN env var is unset or weak (must be >=32 chars and not the default "
+            "'change-me-in-production'). Set a strong AUTH_TOKEN before starting the service."
+        )
     Path(settings.DB_PATH).parent.mkdir(parents=True, exist_ok=True)
     db = await aiosqlite.connect(settings.DB_PATH)
     try: