Function check_startup_auth_posture 

pub fn check_startup_auth_posture(
    auth_enabled: bool,
    has_real_auth: bool,
    bind_host: &str,
    insecure_override: bool,
) -> Result<(), String>

Decide whether bindcar is allowed to start given its authentication posture.

bindcar must not silently expose an unauthenticated (or presence-only) API on a non-loopback interface (B-4). It may start when any of the following holds:

• real authentication is active (auth_enabled && has_real_auth), or
• the bind address is loopback-only, or
• the operator explicitly accepted the risk (insecure_override).

Arguments

• auth_enabled - Whether the auth middleware is applied (!DISABLE_AUTH).
• has_real_auth - Whether a real authenticator is configured (TokenReview feature or a shared secret).
• bind_host - The host portion of the listen address.
• insecure_override - Whether the operator passed the explicit insecure override.

Errors

Returns Err with an operator-facing message when the configuration would expose an unauthenticated API on a non-loopback interface.