Protect internal API endpoints

[josh]

While /webhook needs to be publicly exposed and IP gated, the internal API endpoints should not exactly be public either.

Some options:

1. Add some kind of static auth token
2. Move to separate listener. This could be another internal port or unix socket.

Kinda leaning towards 2. @tnm curious how you intend to deploy. A separate listener means you could implement your own static token auth with nginx frontend or whatever. Or in a container environment, only expose this internal api port to your app. Or only expose the unix socket to your local app. Related #6.

[tnm]

Definitely prefer 2.

[tnm]

We've decided to split off the listeners first, and then add simple token auth on the API routes to start.