Authenticated legacy command execution

Parent

Closes part of #281; parent remains open.

What to build

Protect the legacy /api/command compatibility endpoint using the configuration contract from the first ticket while preserving authorized legacy execution behavior. The endpoint must authenticate with X-HexStrike-Command-Token, retain shell-composition validation and audit outcomes without leaking secrets.

Acceptance criteria

• Disabled API returns 404 and does not invoke execution.
• Missing or invalid token returns 401 and does not invoke execution.
• The token is compared constant-time and is never logged or returned.
• Valid token permits the existing compatibility execution path.
• Malformed requests and rejected shell composition return 400.
• Existing timeout, cache, telemetry, process and result behavior is preserved for valid requests.
• Audit data includes request identifier, outcome, rejection reason where applicable, duration and HTTP status.
• Audit data excludes the raw token and complete command string.
• Route-level tests cover disabled, authentication, malformed, rejected and valid requests.

Blocked by

• Ticket 1: Command API configuration guard (#282)