Merge origin/feature/N7Web into feature/N7Web

Integrate the remote firmware workbench, OTA delivery, and timed mode schedules while preserving the local N7 scene and runtime changes.

tests/e2e/test_http_request_security.py

@@ -89,6 +89,13 @@ class TestMutationRequestSecurity:
         except urllib.error.HTTPError as exc:
             return exc.code, json.loads(exc.read().decode("utf-8"))
 
+    def get(self, path: str) -> tuple[int, dict[str, object]]:
+        try:
+            with urllib.request.urlopen(f"{self.base_url}{path}", timeout=3) as response:
+                return response.status, json.loads(response.read().decode("utf-8"))
+        except urllib.error.HTTPError as exc:
+            return exc.code, json.loads(exc.read().decode("utf-8"))
+
     def test_same_origin_json_assistant_request_is_accepted(self) -> None:
         status, body = self.post(
             "/api/assistant/stream",
@@ -147,6 +154,29 @@ class TestMutationRequestSecurity:
         assert status == 200
         assert MutationSecurityHandler.last_hardware_bypass is False
 
+    def test_vehicle_ota_download_is_public_but_workbench_state_remains_private(self) -> None:
+        MutationSecurityHandler.auth = _auth(enabled=True)
+        try:
+            download_status, download_body = self.get(
+                "/api/firmware-workbench/releases/fw-rel-missing1234/download"
+            )
+            latest_status, latest_body = self.get(
+                "/api/firmware-workbench/releases/latest"
+            )
+            state_status, state_body = self.get("/api/firmware-workbench/state")
+        finally:
+            MutationSecurityHandler.auth = _auth(enabled=False)
+
+        assert download_status == 404
+        assert download_body["error"] == "not_found"
+        assert latest_status in {200, 404}
+        if latest_status == 404:
+            assert latest_body["error"] == "not_found"
+        else:
+            assert latest_body["download_url"]
+        assert state_status == 401
+        assert state_body["error"] == "authentication_required"
+
     def test_hardware_bypass_requires_auth_enabled_and_direct_loopback(self) -> None:
         handler = object.__new__(SeatDemoHandler)
         handler.client_address = ("127.0.0.1", 12345)