feat: add anonymous access configuration for KV endpoints (issue #5)

- Add AllowAnonymousRead and AllowAnonymousWrite config parameters
- Set both to false by default for security
- Apply conditional authentication middleware to KV endpoints:
  - GET requires auth if AllowAnonymousRead is false
  - PUT requires auth if AllowAnonymousWrite is false
  - DELETE always requires authentication (no anonymous delete)
- Update integration tests to enable anonymous access for testing
- Maintain backward compatibility when AuthEnabled is false

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

server/routes.go

@@ -11,10 +11,33 @@ func (s *Server) setupRoutes() *mux.Router {
 	// Health endpoint (always available)
 	router.HandleFunc("/health", s.healthHandler).Methods("GET")
 
-	// KV endpoints (always available - see issue #5 for anonymous access control)
-	router.HandleFunc("/kv/{path:.+}", s.getKVHandler).Methods("GET")
-	router.HandleFunc("/kv/{path:.+}", s.putKVHandler).Methods("PUT")
-	router.HandleFunc("/kv/{path:.+}", s.deleteKVHandler).Methods("DELETE")
+	// KV endpoints (with conditional authentication based on anonymous access settings)
+	// GET endpoint - require auth if anonymous read is disabled
+	if s.config.AuthEnabled && !s.config.AllowAnonymousRead {
+		router.Handle("/kv/{path:.+}", s.authService.Middleware(
+			[]string{"read"}, nil, "",
+		)(s.getKVHandler)).Methods("GET")
+	} else {
+		router.HandleFunc("/kv/{path:.+}", s.getKVHandler).Methods("GET")
+	}
+	
+	// PUT endpoint - require auth if anonymous write is disabled
+	if s.config.AuthEnabled && !s.config.AllowAnonymousWrite {
+		router.Handle("/kv/{path:.+}", s.authService.Middleware(
+			[]string{"write"}, nil, "",
+		)(s.putKVHandler)).Methods("PUT")
+	} else {
+		router.HandleFunc("/kv/{path:.+}", s.putKVHandler).Methods("PUT")
+	}
+	
+	// DELETE endpoint - always require authentication (no anonymous delete)
+	if s.config.AuthEnabled {
+		router.Handle("/kv/{path:.+}", s.authService.Middleware(
+			[]string{"delete"}, nil, "",
+		)(s.deleteKVHandler)).Methods("DELETE")
+	} else {
+		router.HandleFunc("/kv/{path:.+}", s.deleteKVHandler).Methods("DELETE")
+	}
 
 	// Member endpoints (available when clustering is enabled)
 	if s.config.ClusteringEnabled {