1.) Don't allow agent auth to be disabled if running in prod

2.) fix ssrf in the fetch url
3.) fix path traversal vuln when uploading files
4.) added rate limiting to web socket upgrading (very needed)
5.) make token revocation from 5 seconds to 500 ms.

Overlord-Server/src/auth.ts

@@ -20,7 +20,7 @@ const tokenCache = new Map<
   string,
   { payload: JWTPayload; timestamp: number }
 >();
-const TOKEN_CACHE_TTL = 5000;
+const TOKEN_CACHE_TTL = 500;
 
 function getSecretKey(): Uint8Array {
   const config = getConfig();