server

type Options struct {
	// Bind is the "host:port" pair the server listens on. Empty →
	// 127.0.0.1:2365. Non-loopback binds require auth to be configured
	// (unimplemented in v0) and are refused with an explicit error.
	Bind string

	// AllowUnauthenticated is the escape hatch for non-loopback binds
	// without auth. Off by default; the caller must opt in explicitly.
	AllowUnauthenticated bool

	// ReadOnly opens the archive with hive.ReadOnly, refusing writes at
	// the core layer. Default is read-write so hive serve can host both
	// browsing and editing. Set true for public-view deployments.
	ReadOnly bool

	// Actor is the ORCID iD (or other identifier) stamped into
	// col__modified_by on every mutation. Loaded from --orcid flag or
	// HIVE_ORCID env var by the main package; falls back to "local" when
	// nothing is configured (with a single-line warning at startup).
	// In hosted SSO mode this will be overwritten per-request by the
	// auth middleware; for v0 it's a process-wide stamp.
	Actor string
}