fix: reject requests when API_KEY env var is not configured

Empty api_key was silently bypassing authentication. Now raises
RuntimeError on startup-time misconfiguration rather than allowing
unauthenticated access.

app/api/dependencies.py

@@ -5,7 +5,9 @@ settings = get_settings()
 
 
 def verify_api_key(x_api_key: str = Header(...)):
-    if settings.api_key and x_api_key != settings.api_key:
+    if not settings.api_key:
+        raise RuntimeError("API_KEY environment variable is not set")
+    if x_api_key != settings.api_key:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Invalid or missing API key"

app/core/config.py

@@ -10,6 +10,7 @@ class Settings(BaseSettings):
 
     # Set OPENROUTER_API_KEY as a HF Space Secret
     openrouter_api_key: str = ""
+    api_key: str = ""
     llm_model: str = "meta-llama/llama-3.3-70b-instruct"
 
     app_env: str = "production"