feat: implement TASK-WP1-04 admin security

apps/api/src/secure-config.ts

@@ -0,0 +1,22 @@
+import { readFileSync } from "node:fs";
+
+import type { SecureConfigCandidate } from "./registration.js";
+
+export function readSecureConfigCandidate(path: string): SecureConfigCandidate {
+  const parsed = JSON.parse(readFileSync(path, "utf8")) as Record<string, unknown>;
+  if (parsed.schema_version !== 1 || !Number.isSafeInteger(parsed.secure_config_revision)) {
+    throw new Error("secure_config_integrity_invalid");
+  }
+  if (!Array.isArray(parsed.admin_allowlist_hashes) || !Array.isArray(parsed.admin_recovery_hashes)) {
+    throw new Error("secure_config_integrity_invalid");
+  }
+  if (parsed.admin_allowlist_hashes.some((value) => typeof value !== "string")
+    || parsed.admin_recovery_hashes.some((value) => typeof value !== "string")) {
+    throw new Error("secure_config_integrity_invalid");
+  }
+  return {
+    adminAllowlistHashes: parsed.admin_allowlist_hashes as string[],
+    adminRecoveryHashes: parsed.admin_recovery_hashes as string[],
+    secureConfigRevision: parsed.secure_config_revision as number,
+  };
+}