effect-v4

This code implements bearer authorization using the hardcoded token `dev-token` and grants a fixed development identity on success. There is no evidence of malware, exfiltration, or obfuscation, but deploying this implementation in production would allow anyone who knows the token to act as `dev@acme.com`; severity is moderate and context-dependent.