Use HF_TOKEN env var for gated model access

scan.py

@@ -7,7 +7,7 @@ ModelAtlas reference database. No weight download needed — uses config.json on
 This is the heart of the modeldna 'test before you download' feature.
 """
 from __future__ import annotations
-import json, hashlib, re, time
+import json, hashlib, os, re, time
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Optional
@@ -255,7 +255,11 @@ def fetch_config(model_id: str) -> Optional[dict]:
     """Fetch config.json from HuggingFace. Returns None on failure."""
     url = f"{HF_API}/{model_id}/resolve/main/config.json"
     try:
-        r = requests.get(url, timeout=20)
+        headers = {}
+        token = os.environ.get("HF_TOKEN", "")
+        if token:
+            headers["Authorization"] = f"Bearer {token}"
+        r = requests.get(url, headers=headers, timeout=20)
         r.raise_for_status()
         return r.json()
     except Exception as e: