registerProtectedExecutableRoute
public void registerProtectedExecutableRoute(String path, Supplier<File> fileSupplier, Supplier<String> networkKeySupplier)
Registers a dynamically resolved executable JAR route protected by a capability-specific bearer token derived from the RSPM network key.
The supplier is evaluated for every authorized GET/HEAD request, so a newly downloaded update becomes visible without restarting the backend HTTP listener. Missing/incorrect credentials receive 401. A missing network key fails closed with 503; the raw key is never accepted as a bearer token.