amalia/30-apr-26
main
Remove global API_KEY env var and its validation in checkAuth. Auth via x-api-key now exclusively uses clientApiKey per-app validated inline on POST /api/bugs.