[P2.4] Gate the test-only `POST /test/broadcast` behind an env flag

[frankbria]

Severity: low | Category: security | Phase: P2.4

Problem

Verified: mounted unconditionally with only require_auth; any authenticated principal can push arbitrary JSON to every WebSocket subscriber. Docstring says "integration tests only" but nothing gates it.

Evidence

codeframe/ui/server.py:714

Acceptance criteria

Registered only when CODEFRAME_ENABLE_TEST_ENDPOINTS is set, or moved to a test-only app factory.

Dependencies

None

---

_{Filed from the SaaS launch-readiness audit. Atomic: one developer, one session. Work order: strictly P0.1 → P3.12 (no forward dependencies).}

[coderabbitai]

🔗 Related PRs

#148 - fix: Add WebSocket health check and E2E test authentication [merged]
#705 - fix(security): workspace path allowlist + session ownership (#655) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!