Factory route layer behind T3's authentication #57

Outcome

The factory has an HTTP route layer behind T3's own authentication. Every later factory route (#27, #55) is added to it and gets T3's sign-in and scopes for free.

Acceptance criteria

• apps/server/src/factory/t3/ exposes the factory's route layer. server.ts adds it to layerMakeRoutes in one line, and that line is listed in factory/SEAMS.
• The layer uses T3's existing HTTP auth (the same authentication EnvironmentHttpApi gets from AuthHttp.layerAuthenticatedAuth) through the adapter. The factory does not parse tokens or cookies itself.
• It serves one route, GET /api/factory/status, returning { state: "running" | "idle", reason?: string }. idle with a reason covers "no config" and "config failed to load".
• The adapter offers a scope check that routes use. A request without a session gets 401. A test proves 401 without credentials, 200 with a session, and 403 for a session that lacks a scope the route requires (use a test-only route that requires AuthSettingsWriteScope).
• Paired, relay and tunnel sessions authenticate exactly as they do for T3's own HTTP API, and there is no separate factory token.
• Open question 1 in factory/docs/design.md is answered with what was found and moved under a "Decided" heading.

Depends on

None.

Notes

• This settles "use T3 auth" before Factory HTTP API for status, runs and control #27, Factory page in the T3 web app #28 and Factory settings page: edit the machine config at /settings/factory #55 are built on it. Factory HTTP API for status, runs and control #27 adds its routes to this layer and drops its own GET /api/factory/status criterion.
• If T3's auth cannot be applied to a route layer outside EnvironmentHttpApi without editing contracts, stop factory:needs-info. Say which file would need to change and why. Do not add RPC methods.

Reference

• Design: factory/docs/design.md in this repo.
• Upstream's AGENTS.md applies. Run only the tests and typechecks for the paths you touch (vp test run <path>, vp run --filter t3 typecheck), never the repo-wide checks.
• Edit no upstream file that is not listed in factory/SEAMS. A new seam needs a line in factory/SEAMS and a reason in the PR body.