fixed lint

fix(auth): call get_settings() inside verify_api_key — avoid stale module-level settings reference

fix: enforce API key validation in verify_api_key dependency

fix

fix: log warning at startup when API_KEY is unset and auth is disabled

fix

fix(tests): open-access dev mode when API_KEY unset, fix tmp_path test_ skip bug in agent test

fix: reject requests when API_KEY env var is not configured

feat: add API key authentication to POST endpoints