Remove hardcoded proxy secret from image; use masked HF Space secret

Dockerfile

@@ -8,7 +8,10 @@ RUN pip install --no-cache-dir -r requirements.txt
 
 COPY app/ app/
 
-ENV RAPIDAPI_PROXY_SECRET=d814dd20-5b85-11f1-94b1-2f7d6f807838
+# RAPIDAPI_PROXY_SECRET is NOT baked into the image — set it as a masked
+# HF Space secret (Settings → Variables and secrets) using the exact value
+# the RapidAPI gateway injects. While unset, proxy-secret validation stays
+# dormant so live clients are never blocked.
 ENV DATABASE_URL=sqlite:///./revai.db
 ENV SECRET_KEY=revai-production-hf-secret-key-2026