fix(express): require auth token for external signer mode

[0xroyce]

Summary

• Security fix (CWE-306): BitGo Express --signerMode previously mounted /api/v2/{coin}/sign, TSS share, and OFC external sign routes behind prepareBitGo only, which never rejects a missing Authorization header. Any network client that could reach the signer port could use disk-held user keys as an unauthenticated signing oracle.
• Fix: Require signerAuthToken (--signerAuthToken / BITGO_SIGNER_AUTH_TOKEN) whenever signerMode or externalSignerUrl is configured. Signer routes now reject missing/wrong Bearer with HTTP 401 (timing-safe compare). Generator Express forwards the same token when calling externalSignerUrl.
• Reported via whitehat research (Bugcrowd-ready write-up available). Demonstrated locally with researcher-owned key material only.

Breaking change / migration

Operators running external signing must set a shared secret on both the signer and generator Express instances, e.g.:

export BITGO_SIGNER_AUTH_TOKEN='<high-entropy-secret>'
# signer:
bitgo-express --signerMode --signerFileSystemPath ./keys.json --signerAuthToken "$BITGO_SIGNER_AUTH_TOKEN"
# generator:
bitgo-express --externalSignerUrl https://signer.example --signerAuthToken "$BITGO_SIGNER_AUTH_TOKEN"

Test plan

• Unit: unauthenticated /api/v2/tbtc/sign → 401
• Unit: wrong Bearer → 401
• Unit: correct Bearer still signs (existing coinSign coverage)
• Unit: startup without signerAuthToken in signerMode throws ExternalSignerConfigError
• CI full express unit + integration suite

[0xroyce]

Reviewer note (external whitehat)

Validate Humans In The Loop fails because this commit is from an external researcher (@0xroyce) and is not signed by a BitGo allowlisted engineer. That is expected for an outside security fix.

Ask: @bitgo/wallet-core / @bitgo/wallet-core-india — please review + approve (CODEOWNERS needs 2). Happy to adjust the auth design (mTLS vs shared Bearer, rollout flags, docs) if you want a different migration path.

Why this should not wait on “silent discovery”: the broken behavior is already demonstrated (missing Authorization → sign). This PR is the patch. Leaving signerMode unauthenticated while the diff is public is worse than merging/hot-fixing quickly.

[0xroyce]

Closing this PR at researcher request.

We are revisiting disclosure packaging. The underlying finding (signerMode missing authentication) remains valid and will be handled via coordinated disclosure (Bugcrowd / BitGo security), not this public patch PR for now.