[starmorph]

Bearer-token holders can currently sign arbitrary workflow run IDs and use the API to poll or follow up on runs it did not start. Sign question IDs with a required, API-only QUESTION_ID_SECRET, independent of API_TOKEN, and reject invalid signatures before accessing workflows.

The Blueprint generates the new secret. Existing deployments must configure a distinct secret of at least 32 characters before upgrading; old question IDs become invalid. Keep this secret stable across API replicas and restarts. Rotating only the bearer token preserves ID signatures.

Validation:

• Reproduced the original forged-ID regression: polling returned 200 and follow-up returned 202; both now return 404 without workflow access.
• API tests: 18 passed, including issued IDs, key rotation, and fail-closed configuration.
• Independently reran typecheck and the full suite: 84 passed, 1 live-model test skipped. git diff --check passed.

Fixes #20.