fix(test): update monitor auth test for WS-safe router config

The router-level token_dep was intentionally removed (PR #2063) because
it broke WebSocket upgrades. Update the structural test to assert the
dependency is absent — auth is enforced by AuthGateMiddleware.

Author: ntohidi

deploy/docker/tests/test_security_2026_04.py

@@ -138,14 +138,17 @@ def test_traversal_validator_removed(self):
 
 class TestMonitorAuthStructural(unittest.TestCase):
 
-    def test_monitor_router_has_auth(self):
+    def test_monitor_router_has_no_http_only_dep(self):
+        """Router-level token_dep was removed because it is HTTP-only and broke
+        the WebSocket upgrade on /monitor/ws.  Auth is enforced by
+        AuthGateMiddleware; destructive routes keep Depends(require_admin)."""
         with open(os.path.join(DEPLOY_DIR, "server.py")) as f:
             source = f.read()
-        # Find the line with monitor_router
         for line in source.splitlines():
             if "monitor_router" in line and "include_router" in line:
-                self.assertIn("dependencies=", line,
-                    "Monitor router must have dependencies=[Depends(token_dep)]")
+                self.assertNotIn("dependencies=", line,
+                    "Monitor router must NOT have router-level token_dep "
+                    "(breaks WS); auth is enforced by AuthGateMiddleware")
                 return
         self.fail("Could not find monitor_router include_router line")