feat(noema): add signed gateway settings

[seonghobae]

Summary

• add signed-session GET/PUT /api/noema-gateway for the current (user_id, organization_id) scope
• validate HTTPS /v1 gateway URLs through the existing allowlist and global-address policy
• persist the gateway token through EncryptedString, return only readiness metadata, and write generic audit records
• record ADR-0005 and the customer-facing setup contract

This is intentionally stacked on #1384. It does not add mailbox fields, target-user administration, upstream provider keys, a model picker, or a Figma surface.

Verification

• PYTHONWARNINGS=error python -m pytest backend/tests/test_noema_config_api.py backend/tests/test_noema_agent.py backend/tests/test_orchestrator_gateway.py backend/tests/test_bootstrap_db.py -q — 71 passed, 1 skipped
• python -m coverage run --source=backend -m pytest backend/tests/test_noema_config_api.py -q — 14 passed
• python -m coverage report -m backend/api/noema_config.py — 100%
• ruff check ..., git diff --check, and Bandit on the new API — passed

@opencode-agent @cwl-noema-review Please review exact current head after Checks materialize. The token must never appear in response, audit, log, or error text, and the route must remain scoped to the signed session.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 16ba3955-6560-4b53-9eab-9beda5d0bfd6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent @cwl-noema-review Please review exact current head f7e5f5b637f37f7101bb6e358c162c511f072903 for stacked PR #1425 on parent cursor/noema-orchestrator-decision-agent-816f@5f374ff36cc5d4241dadda0c50ae4ad164ffe137.

The signed-session /api/noema-gateway route is scoped to the authenticated (user_id, organization_id), validates HTTPS /v1 through the existing allowlist, Fernet-stores the token, returns only readiness metadata, and writes generic audit records. ADR-0005 and doctoring now map the security controls to OWASP ASVS 5.0.0 and NIST SP 800-63B-4. Local evidence remains: full backend 1805 passed, 32 skipped; new API module 100% coverage; Ruff, diff check, and Bandit passed. Reassess only this SHA and current-head Checks; do not reuse stale approvals, bypass rules, or merge while required evidence is pending.