fix: enforce API key validation in verify_api_key dependency

app/api/dependencies.py

@@ -1,4 +1,4 @@
-from fastapi import Header
+from fastapi import Header, HTTPException
 from typing import Optional
 from app.core.config import get_settings
 
@@ -7,10 +7,11 @@ settings = get_settings()
 
 def verify_api_key(x_api_key: Optional[str] = Header(default=None)) -> None:
     if not settings.api_key:
-        # API_KEY not configured — open access (dev/HF Spaces mode)
         import logging
         logging.getLogger(__name__).warning(
             "WARNING: API_KEY is not set — all endpoints are publicly accessible. "
             "Set API_KEY in your .env or environment to enable authentication."
         )
-        return
+        return
+    if x_api_key != settings.api_key:
+        raise HTTPException(status_code=401, detail="Invalid or missing API key")