fix(express): require auth token for external signer mode - #9452

Summary

• Security fix (CWE-306): BitGo Express --signerMode previously mounted /api/v2/{coin}/sign, TSS share, and OFC external sign routes behind prepareBitGo only, which never rejects a missing Authorization header. Any network client that could reach the signer port could use disk-held user keys as an unauthenticated signing oracle.
• Fix: Require signerAuthToken (--signerAuthToken / BITGO_SIGNER_AUTH_TOKEN) whenever signerMode or externalSignerUrl is configured. Signer routes now reject missing/wrong Bearer with HTTP 401 (timing-safe compare). Generator Express forwards the same token when calling externalSignerUrl.
• Reported via whitehat research (Bugcrowd-ready write-up available). Demonstrated locally with researcher-owned key material only.

Breaking change / migration

Operators running external signing must set a shared secret on both the signer and generator Express instances, e.g.:

export BITGO_SIGNER_AUTH_TOKEN='<high-entropy-secret>'
# signer:
bitgo-express --signerMode --signerFileSystemPath ./keys.json --signerAuthToken "$BITGO_SIGNER_AUTH_TOKEN"
# generator:
bitgo-express --externalSignerUrl https://signer.example --signerAuthToken "$BITGO_SIGNER_AUTH_TOKEN"

Test plan

• Unit: unauthenticated /api/v2/tbtc/sign → 401
• Unit: wrong Bearer → 401
• Unit: correct Bearer still signs (existing coinSign coverage)
• Unit: startup without signerAuthToken in signerMode throws ExternalSignerConfigError
• CI full express unit + integration suite