Fix gateway auth on private Space: check ?key=/cookie before Authorization

A private HF Space reserves the Authorization: Bearer header for its own HF
token, which collided with the gateway reading the API_KEY from the same header
(deadlock: send HF token -> "unauthorized"; send API_KEY -> HF 404). Reorder
authOK() to read ?key= and the apikey cookie first, falling back to
Authorization only when both are absent. Backward-compatible for public Spaces.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

monitor/main.go

@@ -542,15 +542,19 @@ func authOK(w http.ResponseWriter, r *http.Request) bool {
 		http.Error(w, "gateway disabled: API_KEY not set on the server", http.StatusServiceUnavailable)
 		return false
 	}
-	got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-	if got == "" {
-		got = r.URL.Query().Get("key")
-	}
+	// Check ?key= and the apikey cookie BEFORE the Authorization header. On a
+	// private HF Space the platform claims Authorization: Bearer <HF_token>, so the
+	// API key must travel via ?key= or the cookie; only fall back to Authorization
+	// (public Space / OpenAI-compatible clients) when those are absent.
+	got := r.URL.Query().Get("key")
 	if got == "" {
 		if c, err := r.Cookie("apikey"); err == nil {
 			got = c.Value
 		}
 	}
+	if got == "" {
+		got = strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+	}
 	if got != apiKey {
 		http.Error(w, "unauthorized", http.StatusUnauthorized)
 		return false