fix(dashboard): whitelist exposed torch-config.json fields

Restrict the /torch-config.json endpoint to only return fields required by the dashboard frontend (dashboard config excluding auth, and nostrLock namespace/relays). This prevents exposure of sensitive internal configuration such as rosters, scheduler settings, and full relay lists.

- Modify src/dashboard.mjs to sanitize config using an allowlist approach.
- Add test/dashboard-config-exposure.test.mjs to verify sensitive fields are stripped.

Co-authored-by: PR0M3TH3AN <[email protected]>

src/dashboard.mjs

@@ -105,14 +105,24 @@ export async function cmdDashboard(port = DEFAULT_DASHBOARD_PORT, host = '127.0.
           const rawConfig = JSON.parse(configContent);
           const safeConfig = parseTorchConfig(rawConfig);
 
-          // Security: Sanitize sensitive fields
-          if (safeConfig.dashboard) {
-            delete safeConfig.dashboard.auth;
+          // Security: Whitelist only fields required by the dashboard frontend
+          const publicConfig = {
+            dashboard: safeConfig.dashboard ? { ...safeConfig.dashboard } : {},
+            nostrLock: safeConfig.nostrLock
+              ? {
+                  namespace: safeConfig.nostrLock.namespace,
+                  relays: safeConfig.nostrLock.relays,
+                }
+              : {},
+          };
+
+          // Remove sensitive dashboard auth
+          if (publicConfig.dashboard.auth) {
+            delete publicConfig.dashboard.auth;
           }
-          delete safeConfig.configPath;
 
           res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify(safeConfig, null, 2));
+          res.end(JSON.stringify(publicConfig, null, 2));
           return;
         } catch (err) {
           console.error('Error parsing torch-config.json:', err);