The five-minute audit

Implement security_gate(handlers) — stricter cousin of the practice audit: - each handler: {'name', 'checks': set, 'public': bool} where 'public' marks endpoints intentionally unauthenticated (health checks) - an endpoint that is NOT public must have 'auth' AND 'owner' (data endpoints) — missing either → vulnerable with 'critical': True - an endpoint that IS public but has any of 'auth'/'owner' checks is suspicious (flag 'suspicious': True — why would a health check need auth code?) - missing 'params' or 'encode' → vulnerable (not critical) - return {'clean': [...], 'vulnerable': [...worst-first, ties by name...]} where vulnerable entries carry 'missing' (sorted), and 'critical'/'suspicious' booleans only when True