refactor: replace global API_KEY with per-app clientApiKey

Remove global API_KEY env var and its validation in checkAuth.
Auth via x-api-key now exclusively uses clientApiKey per-app
validated inline on POST /api/bugs.

src/lib/env.ts

@@ -17,7 +17,6 @@ export const env = {
   GOOGLE_CLIENT_ID: required('GOOGLE_CLIENT_ID'),
   GOOGLE_CLIENT_SECRET: required('GOOGLE_CLIENT_SECRET'),
   SUPER_ADMIN_EMAILS: optional('SUPER_ADMIN_EMAIL', '').split(',').map(e => e.trim()).filter(Boolean),
-  API_KEY: required('API_KEY'),
   MINIO_ENDPOINT: required('MINIO_ENDPOINT'),
   MINIO_PORT: parseInt(optional('MINIO_PORT', '443'), 10),
   MINIO_USE_SSL: optional('MINIO_USE_SSL', 'true') === 'true',