add a hard kill switch for the proxy

PROXY_DISABLED short-circuits all three gate points (status check, the
gated route, and the wisp upgrade handler) to closed, so nobody gets in
even with the right password or a cookie from before this was flipped on

index.js

@@ -85,6 +85,9 @@ app.use(express.json({ limit: "10mb" }));
 app.use(express.urlencoded({ extended: false }));
 app.use(express.text());
 
+// hard kill switch: when true, the proxy is unreachable for everyone, no exceptions -
+// existing unlock cookies, a correct beta code, none of it matters while this is true.
+const PROXY_DISABLED = true;
 const proxyPasswordPath = path.join(process.env.DATA_PATH, ".cache_meta");
 function getProxyPassword() {
 	try {
@@ -101,11 +104,13 @@ function proxyUnlockToken() {
 	return crypto.createHash("sha256").update(password).digest("hex");
 }
 function isProxyUnlocked(req) {
+	if (PROXY_DISABLED) return false;
 	const expected = proxyUnlockToken();
 	if (!expected) return true;
 	return req.cookies.proxy_unlock === expected;
 }
 function isProxyUnlockedRawCookieHeader(cookieHeader) {
+	if (PROXY_DISABLED) return false;
 	const expected = proxyUnlockToken();
 	if (!expected) return true;
 	const match = (cookieHeader || "").split(";").map((c) => c.trim()).find((c) => c.startsWith("proxy_unlock="));
@@ -113,6 +118,10 @@ function isProxyUnlockedRawCookieHeader(cookieHeader) {
 	return decodeURIComponent(match.slice("proxy_unlock=".length)) === expected;
 }
 app.post("/api/proxy/unlock", (req, res) => {
+	if (PROXY_DISABLED) {
+		res.status(400).send({ success: false, message: "beta access is currently disabled." });
+		return;
+	}
 	const password = getProxyPassword();
 	if (!password) {
 		res.status(400).send({ success: false, message: "beta access is not configured." });