fix(gateway): restore disabled auth on auto-start

[Xuleileon]

Summary

• centralize loading of the persisted inbound-auth setting
• apply the setting to both manual and automatic gateway startup
• add regression coverage for the secure default and persisted disabled state

Root cause

start_gateway restored gateway.auth_disabled after creating GatewayState, but the desktop auto-start path created the same state without restoring the setting. Relaunching the app therefore reverted a configured no-auth gateway to auth-required until the user toggled the setting again.

Impact

When Disable authentication is enabled, relaunching McpMux now preserves that behavior. A missing setting or repository read failure still defaults to authentication required.

Validation

• cargo +1.88.0 fmt --all -- --check
• cargo +1.88.0 test -p mcpmux --lib — 34 passed
• cargo +1.88.0 clippy -p mcpmux --lib -- -D warnings -A clippy::uninlined_format_args

The narrow Clippy allowance is for a pre-existing Rust 1.88 lint in crates/mcpmux-core/build.rs; the changed files pass with warnings denied.

[its-mash]

@claude review

[claude]

Claude finished @its-mash's task in 1m 22s —— View job

---

Claude review

• Gather context (fetch branch, read diff)
• Understand the request (@claude review)
• Review apps/desktop/src-tauri/src/commands/gateway.rs
• Review apps/desktop/src-tauri/src/lib.rs
• Post review feedback

Summary

This is a clean, well-scoped fix. The root cause described (auto-start built GatewayState without restoring the persisted gateway.auth_disabled setting, unlike start_gateway) checks out — I traced both code paths and confirmed the bug and the fix.

What's good

• Correct fix, symmetric with existing pattern. The new load_gateway_auth_disabled_from_repo / load_gateway_auth_disabled helpers in gateway.rs (lines 220–234) mirror the existing load_network_access_from_repo / load_network_access pair exactly — good consistency with the established convention in this file.
• No race condition. I checked ordering in both paths:
  • lib.rs:490-492 — auth_disabled is loaded (line 428-430) and applied to gw_inner_state before server.spawn() (line 537), so the HTTP listener never accepts connections with the wrong auth state.
  • gateway.rs:1056-1058 (start_gateway) — same ordering already existed and is preserved, just refactored to use the shared helper.
• Safe default preserved. Both the missing-setting and repository-error cases fall through to unwrap_or(false) → auth required, matching the PR's stated "secure default" guarantee.
• Regression tests are meaningful, not just padding. auth_remains_required_when_disable_setting_is_missing and persisted_disable_setting_is_restored_on_gateway_start exercise the real SqliteAppSettingsRepository against an in-memory DB rather than mocking the repo trait, so they'd have caught this exact bug (auto-start path bypassing the restore).

Minor observations (non-blocking)

• get_gateway_auth_disabled (the #[tauri::command] at gateway.rs:1256-1264) still duplicates the same read-and-parse logic inline instead of delegating to the new load_gateway_auth_disabled_from_repo. Behaviorally they differ slightly on purpose (the command surfaces repo errors to the frontend via Result, the new helper swallows them into the secure default), so this isn't a bug — just a spot that could be tightened for a future cleanup if desired. Not worth blocking this PR on.
• No changes needed to lib.rs beyond what's here — the auto-start path now matches start_gateway exactly in behavior for auth, network access, and public base URL restoration.

No correctness, security, or style issues found. The narrow -A clippy::uninlined_format_args allowance mentioned in the PR description is scoped to a pre-existing lint in mcpmux-core/build.rs, unrelated to these changes.

Verdict: LGTM.