feat(mission-control): restore MC tabs - temple, office, memory, claude, pdf-viewer, resume, resume-upload, temple-3d, demos

Also added:
- Memory API endpoints
- Briefs API endpoints
- AnveVoice stats API
- Claude spawn API
- TTS proxy
- Cleopatra voice widget
- api-auth middleware

app/api/morning/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import fs from "fs";
 import path from "path";
 
+const API_SECRET = process.env.API_SECRET || 'horus-mc-secret-2026';
 const STORAGE_FILE = path.join(process.cwd(), "data", "morning_briefs.json");
 
 const DISCORD_BOT_TOKEN = process.env.DISCORD_BOT_TOKEN || "MTQ3MTk4OTUzNjE1MzQwMzU5Nw.Ghtj4n.g-tl-Ijhfn9cg6zUCUIVd94EdwL32KmlVgRoSc";
@@ -47,12 +48,24 @@ ${(data.priorities || []).map((p: string, i: number) => `${i + 1}. ${p}`).join('
 ${(data.leads || []).map((l: string) => `- ${l}`).join('\n')}`;
 }
 
-export async function GET() {
+export async function GET(request: NextRequest) {
+  // Check auth
+  const authHeader = request.headers.get('authorization');
+  if (authHeader !== `Bearer ${API_SECRET}`) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+  
   const briefs = getBriefs();
   return NextResponse.json(briefs);
 }
 
 export async function POST(request: NextRequest) {
+  // Check auth
+  const authHeader = request.headers.get('authorization');
+  if (authHeader !== `Bearer ${API_SECRET}`) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+  
   try {
     const body = await request.json();