Function ensure_api_secrets_enforceable 

fn ensure_api_secrets_enforceable(
    has_iroh_api: bool,
    force_api_secrets: &ApiSecrets,
) -> Result<()>

Refuse to run with API secrets that we cannot actually enforce.

The websocket API rejects unauthenticated requests in an HTTP middleware, but the Iroh API carries no credentials at all: every request is dispatched to the endpoint handler without any check. Serving both at once therefore leaves the whole non-privileged client API open to anyone who knows a guardian’s Iroh node id, which is public information contained in every invite code. Since the invite_code endpoint hands out the invite code, and with it the secret itself, that also defeats the websocket API.

Failing to start turns that silent hole into a configuration error the operator can see and act on.