feat: opt-in API-key auth for saas_web via CODEC_CARVER_API_KEYS

[seonghobae]

Summary

Adds opt-in API-key authentication to the SaaS web app (saas_web.py) — the minimal step toward controlled deployment beyond localhost.

• If env var CODEC_CARVER_API_KEYS is set (comma-separated keys), all requests except GET / (the upload UI page) require an X-API-Key header matching one of the configured keys; failures get 401 {"error": "Invalid or missing API key"}.
• If unset (or only empty entries), behavior is exactly as today: fully open.
• Keys are read from os.environ at request time, so key rotation needs no restart.
• New middleware follows the existing @app.middleware("http") pattern and is registered between the size-limit and security-headers middlewares, so 401 responses still carry security headers and unauthenticated requests are rejected before body streaming.

Security

• Constant-time comparison via hmac.compare_digest against each configured key.
• Keys are never logged and never echoed in responses.
• Whitespace around keys is stripped; empty entries are ignored.

Tests

New TestApiKeyAuth class (10 tests) using TestClient + patch.dict(os.environ):

• no env var → /shrink open as before
• env set + no header → 401; wrong key → 401
• correct key → passes through to handler
• GET / always 200 without a key
• multiple comma-separated keys all valid
• whitespace stripped, empty entries ignored, only-empty env stays open
• direct unit test of get_configured_api_keys() parsing

Gates

• coverage report --include=saas_web.py → 100% (114 stmts, 0 miss)
• interrogate -c pyproject.toml saas_web.py → 100%
• unittest discover -s tests → 123 tests, no new failures (only the baseline 5 macOS os.listxattr errors)

🤖 Generated with Claude Code