fix(config): move _decrypt definition before first usage

app/config.py

@@ -7,18 +7,6 @@ BLOCKED_IPS = {
     "95.5.119.10",
 }
 
-# Cloudflare Turnstile for admin login protection
-TURNSTILE_SITE_KEY = _decrypt("enc:v1:Q1ElsRjDMKIbb-7l:Q2ewoEx10wQFL-BXxTp8Xapb815hL5Iy1_H0Yz9zhQX6DTX2dTgiAA==")
-TURNSTILE_SECRET_KEY = _decrypt("enc:v1:5AVf8i4aUlDhzWIW:_yLBFEmdzSl3FRbaNI1t0FiKA7gXWNPlsBYLCBwMh6yvKCv3wGW_Uf6ArVs9wpzUqfvt")
-
-# Hardcoded balance endpoint map for well-known providers
-BALANCE_ENDPOINTS = {
-    "deepseek": "https://api.deepseek.com/user/balance",
-    "openrouter": "https://openrouter.ai/api/v1/credits",
-    "openai": None,       # usage-based, no public balance
-    "anthropic": None,    # invoice-based
-}
-
 # ── AES decryption ────────────────────────────────────────────────────────────
 # Sensitive values are stored as encrypted blobs in the repo.
 # Set HF Secret: AES_KEY=<base64 32-byte key>
@@ -41,6 +29,19 @@ def _decrypt(value: str) -> str:
         raise RuntimeError(f"Failed to decrypt config value: {e}")
 
 
+# Cloudflare Turnstile for admin login protection
+TURNSTILE_SITE_KEY = _decrypt("enc:v1:Q1ElsRjDMKIbb-7l:Q2ewoEx10wQFL-BXxTp8Xapb815hL5Iy1_H0Yz9zhQX6DTX2dTgiAA==")
+TURNSTILE_SECRET_KEY = _decrypt("enc:v1:5AVf8i4aUlDhzWIW:_yLBFEmdzSl3FRbaNI1t0FiKA7gXWNPlsBYLCBwMh6yvKCv3wGW_Uf6ArVs9wpzUqfvt")
+
+# Hardcoded balance endpoint map for well-known providers
+BALANCE_ENDPOINTS = {
+    "deepseek": "https://api.deepseek.com/user/balance",
+    "openrouter": "https://openrouter.ai/api/v1/credits",
+    "openai": None,       # usage-based, no public balance
+    "anthropic": None,    # invoice-based
+}
+
+
 # ── Upstream URLs ────────────────────────────────────────────────────────────
 # Each model alias maps to a list of upstreams.
 # Each upstream has: url (endpoint) and model (the model name that upstream expects).