Collector auth enforcement doesn't cover the fluentforward receiver (port 24225) #3453

What happened?

When a team has collector authentication enforced, the OpAMP config adds bearer-token auth to the otlp/hyperdx and datadog receivers, but the fluentforward receiver stays in the logs/in pipeline on 0.0.0.0:24225. The upstream fluentforwardreceiver has no auth setting (its config is only endpoint), so anything that can reach that port can write logs into ClickHouse without an API key, including rows routed to hyperdx_sessions via the rr-web.event attribute.

Enforcement is on by default: POST /register/password creates the team with collectorAuthenticationEnforced: true, and docker-compose.yml publishes 24225:24225. So a default Docker Compose install accepts unauthenticated logs on 24225 while rejecting them on 4317/4318.

Expected: with enforcement on, every ingest path requires an API key, the same as docker/otel-collector/config.standalone.auth.yaml, which leaves fluentforward out.

Steps to reproduce

Reproduces on play.hyperdx.io? N/A (needs ingest access)

Starting point: fresh yarn dev on main, then register an account (the team gets collector auth enforced). Ports below are for your worktree's slot; the dev portal at http://localhost:9900 lists them.

1. Check OTLP enforces the key:
   curl -s -o /dev/null -w '%{http_code}\n' -X POST localhost:<otel-http-port>/v1/logs -H 'Content-Type: application/json' -d '{}'
   → 401
2. Send a log over Fluent Forward with no key, from a container on the dev stack's network:
   docker run --rm --network hdx-dev-<slot>_internal fluent/fluent-bit:3.2 -i dummy -p 'dummy={"message":"fluent-nokey"}' -p samples=3 -o forward -p host=otel-collector -p port=24225 -f 1
   (Ctrl-C after ~10 seconds)
3. Count the rows:
   curl -s localhost:<clickhouse-http-port> --data-binary "SELECT count() FROM default.otel_logs WHERE Body LIKE '%fluent-nokey%'"
   → 3. The logs were stored without any API key.

How are you running HyperDX?

Local dev stack (yarn dev) from main. Any deployment where the collector gets its config over OpAMP and 24225 is reachable is affected; Docker Compose publishes it by default.

Where does it show up?

OpenTelemetry collector (config generated by the API's OpAMP server).

Logs