fix: log warning at startup when API_KEY is unset and auth is disabled

app/api/dependencies.py

@@ -8,9 +8,9 @@ settings = get_settings()
 def verify_api_key(x_api_key: Optional[str] = Header(default=None)) -> None:
     if not settings.api_key:
         # API_KEY not configured — open access (dev/HF Spaces mode)
-        return
-    if x_api_key != settings.api_key:
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Invalid or missing API key",
-        )
+        import logging
+        logging.getLogger(__name__).warning(
+            "WARNING: API_KEY is not set — all endpoints are publicly accessible. "
+            "Set API_KEY in your .env or environment to enable authentication."
+        )
+        return