fix: inject AGENTMEMORY_SECRET via Caddy so dashboard viewer works

Caddyfile

@@ -3,13 +3,16 @@
     handle /stream/* {
         reverse_proxy localhost:3112 {
             header_up Host localhost:3112
+            header_up Authorization "Bearer {env.AGENTMEMORY_SECRET}"
         }
     }
 
     # Route REST API endpoints (iii-http on 3111)
+    # Caddy injects the secret so the dashboard viewer works without exposing it to the browser
     handle /agentmemory/* {
         reverse_proxy localhost:3111 {
             header_up Host localhost:3111
+            header_up Authorization "Bearer {env.AGENTMEMORY_SECRET}"
         }
     }