Ensure audio stream handler requires POST

docs/pro-runtime-hardening-workboard.md

@@ -413,7 +413,9 @@ Diese Punkte könnten ggf. vorgezogen werden, auch wenn WS-05 formal nach WS-01/
 - Noch leer
 
 ## WS-05 Verifikation
-- Noch leer
+| Datum | Fokus | Ergebnis |
+|---|---|---|
+| 2026-04-05 | `/audio/stream` rejects non-POST requests | `TestAudioStreamRejectsNonPost` enforces POST-only access to `/audio/stream` before a stream source is configured |
 
 ---
 

internal/control/control_test.go

@@ -167,6 +167,16 @@ func TestAudioStreamPushesPCM(t *testing.T) {
 	}
 }
 
+func TestAudioStreamRejectsNonPost(t *testing.T) {
+	srv := NewServer(cfgpkg.Default())
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/audio/stream", nil)
+	srv.Handler().ServeHTTP(rec, req)
+	if rec.Code != http.StatusMethodNotAllowed {
+		t.Fatalf("expected 405 for audio stream GET, got %d", rec.Code)
+	}
+}
+
 func TestTXStartWithoutController(t *testing.T) {
 	srv := NewServer(cfgpkg.Default())
 	rec := httptest.NewRecorder()