Reuse pairing, local binding defaults, auth separation, and secret protection

[yacosta738]

Summary

Carry forward the secure-by-default behavior from Corvus so the standalone product does not accidentally widen exposure while centralizing provider credentials.

Why this matters

This is one of the smallest independently shippable slices needed to make the parent issue real without mixing concerns or leaking product logic across layers.

Parent issue

DALLAY-291 Security hardening, observability, and acceptance validation for Rook v1

Scope

• deliver the parent issue slice described in the title
• keep contracts reusable by the other Rook surfaces where applicable
• add or update targeted validation for the new behavior

Acceptance criteria

• the scope in this issue is implemented end to end
• behavior is covered by targeted tests or an explicit validation strategy
• the resulting contract is documented where operators or other developers need it

References

• clients/agent-runtime/src/gateway/admin.rs
• clients/agent-runtime/src/auth/profiles.rs
• tmp/2026-04-19-local-first-provider-gateway-prd-rfc.md §5, §15

[linear]

DALLAY-310