fix: add auth flow to review page (#679)

* fix: add auth flow to review page like admin

- make /review/:id HTML page public (keep data/submit protected)
- add auth input, localStorage token check/save
- send X-Moderation-Key header with submit request
- handle 401 by showing auth prompt again

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

* ci: only check rust services that actually changed

use dorny/paths-filter to detect which service changed,
skip cargo check and docker build for unchanged services.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

---------

Co-authored-by: Claude Opus 4.5 <[e-mail]>

.github/workflows/check-rust.yml

···
   contents: read
 
 jobs:
+  changes:
+    name: detect changes
+    runs-on: ubuntu-latest
+    outputs:
+      moderation: ${{ steps.filter.outputs.moderation }}
+      transcoder: ${{ steps.filter.outputs.transcoder }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            moderation:
+              - 'moderation/**'
+              - '.github/workflows/check-rust.yml'
+            transcoder:
+              - 'transcoder/**'
+              - '.github/workflows/check-rust.yml'
+
   check:
     name: cargo check
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    needs: changes
 
     strategy:
+      fail-fast: false
       matrix:
-        service: [moderation, transcoder]
+        include:
+          - service: moderation
+            changed: ${{ needs.changes.outputs.moderation }}
+          - service: transcoder
+            changed: ${{ needs.changes.outputs.transcoder }}
 
     steps:
       - uses: actions/checkout@v4
+        if: matrix.changed == 'true'
 
       - name: install rust toolchain
+        if: matrix.changed == 'true'
         uses: dtolnay/rust-toolchain@stable
 
       - name: cache cargo
+        if: matrix.changed == 'true'
         uses: Swatinem/rust-cache@v2
         with:
           workspaces: ${{ matrix.service }}
 
       - name: cargo check
+        if: matrix.changed == 'true'
         working-directory: ${{ matrix.service }}
         run: cargo check --release
 
+      - name: skip (no changes)
+        if: matrix.changed != 'true'
+        run: echo "skipping ${{ matrix.service }} - no changes"
+
   docker-build:
     name: docker build
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    needs: check
+    needs: [changes, check]
 
     strategy:
+      fail-fast: false
       matrix:
-        service: [moderation, transcoder]
+        include:
+          - service: moderation
+            changed: ${{ needs.changes.outputs.moderation }}
+          - service: transcoder
+            changed: ${{ needs.changes.outputs.transcoder }}
 
     steps:
       - uses: actions/checkout@v4
+        if: matrix.changed == 'true'
 
       - name: build docker image
+        if: matrix.changed == 'true'
         working-directory: ${{ matrix.service }}
         run: docker build -t ${{ matrix.service }}:ci-test .
+
+      - name: skip (no changes)
+        if: matrix.changed != 'true'
+        run: echo "skipping ${{ matrix.service }} - no changes"

moderation/src/auth.rs

···
     let path = req.uri().path();
 
     // Public endpoints - no auth required
-    // Note: /admin serves HTML, auth is handled client-side for API calls
+    // Note: /admin and /review/:id serve HTML, auth is handled client-side for API calls
     // Static files must be public for admin UI CSS/JS to load
+    let is_review_page = path.starts_with("/review/")
+        && !path.ends_with("/data")
+        && !path.ends_with("/submit");
     if path == "/"
         || path == "/health"
         || path == "/sensitive-images"
         || path == "/admin"
+        || is_review_page
         || path.starts_with("/static/")
         || path.starts_with("/xrpc/com.atproto.label.")
     {

moderation/src/review.rs

···
             <div class="batch-info">{} pending {}</div>
         </header>
 
-        <form id="review-form" class="review-form">
+        <div class="auth-section" id="auth-section">
+            <input type="password" id="auth-token" placeholder="auth token"
+                   onkeyup="if(event.key==='Enter')authenticate()">
+            <button class="btn-submit" onclick="authenticate()">authenticate</button>
+        </div>
+
+        <form id="review-form" class="review-form" style="display: none;">
             <div class="flags-list">
                 {}
             </div>
···
     <script>
         const form = document.getElementById('review-form');
         const submitBtn = document.getElementById('submit-btn');
+        const authSection = document.getElementById('auth-section');
         const batchId = '{}';
 
+        let currentToken = '';
         const decisions = {{}};
 
+        function authenticate() {{
+            const token = document.getElementById('auth-token').value;
+            if (token && token !== '••••••••') {{
+                localStorage.setItem('mod_token', token);
+                currentToken = token;
+                showReviewForm();
+            }}
+        }}
+
+        function showReviewForm() {{
+            authSection.style.display = 'none';
+            form.style.display = 'block';
+        }}
+
+        // Check for saved token on load
+        const savedToken = localStorage.getItem('mod_token');
+        if (savedToken) {{
+            currentToken = savedToken;
+            document.getElementById('auth-token').value = '••••••••';
+            showReviewForm();
+        }}
+
         function updateSubmitBtn() {{
             const count = Object.keys(decisions).length;
             submitBtn.disabled = count === 0;
···
             try {{
                 const response = await fetch(`/review/${{batchId}}/submit`, {{
                     method: 'POST',
-                    headers: {{ 'Content-Type': 'application/json' }},
+                    headers: {{
+                        'Content-Type': 'application/json',
+                        'X-Moderation-Key': currentToken
+                    }},
                     body: JSON.stringify({{
                         decisions: Object.entries(decisions).map(([uri, decision]) => ({{ uri, decision }}))
                     }})
                 }});
+
+                if (response.status === 401) {{
+                    localStorage.removeItem('mod_token');
+                    currentToken = '';
+                    authSection.style.display = 'flex';
+                    form.style.display = 'none';
+                    document.getElementById('auth-token').value = '';
+                    alert('invalid token');
+                    return;
+                }}
 
                 if (response.ok) {{
                     const result = await response.json();
···
 h1 { font-size: 1.25rem; font-weight: 600; color: #fff; }
 .batch-info { font-size: 0.875rem; color: #888; }
 .status-badge { font-size: 0.7rem; background: #1a3a1a; color: #6d9; padding: 2px 6px; border-radius: 4px; margin-left: 8px; }
+
+.auth-section {
+    display: flex;
+    gap: 10px;
+    margin-bottom: 20px;
+    align-items: center;
+}
+.auth-section input[type="password"] {
+    flex: 1;
+    padding: 10px 12px;
+    background: #1a1a1a;
+    border: 1px solid #333;
+    border-radius: 6px;
+    color: #fff;
+    font-size: 0.875rem;
+}
+.auth-section input:focus {
+    outline: none;
+    border-color: #4a9eff;
+}
+
 .flags-list { display: flex; flex-direction: column; gap: 12px; }
 
 .review-card {