# Secure Modal Klein Endpoint

## Why

The Modal Klein worker exposes `POST /generate` without an app-level token. Modal URLs are not meant to be treated as secrets, and image generation can consume paid compute. The endpoint should support a simple shared-token guard while keeping local fallback behavior unchanged.

## What Changes

- Add optional `KLEIN_MODAL_TOKEN` configuration.
- Send the token from Tiny Narrator to the Modal worker when configured.
- Require the token in the Modal worker when configured there.
- Keep unauthenticated behavior only when no token is configured, so local tests and demos remain simple.
- Ensure runtime setup/status never exposes the token value.

## Capabilities

- `modal-klein-token-auth`: protect live Klein generation with bearer or app token headers.
- `safe-modal-status`: perform health checks with auth when required.
- `secret-redaction`: document and verify that token values are never leaked.

## Non-Goals

- Do not add user accounts or browser login.
- Do not require auth for local fallback generation.
- Do not change the `/api/generate-image` browser-facing contract.
- Do not hard-code secrets in code, docs, or verifier fixtures.

## Impact

- `app.py` will read `KLEIN_MODAL_TOKEN` and attach it to Modal worker requests.
- `modal_workers/klein_image.py` will validate the incoming token when configured.
- `.env.example`, README, and runtime setup text will document the token.
- `scripts/verify.py` will check auth wiring and secret redaction.