add API auth (#150 #151): MUZICK_API_KEY + MUZICK_ADMIN_KEY via Bearer token

backend/src/app.ts

@@ -91,7 +91,25 @@ export async function buildApp(config: AppConfig) {
   // the first search request doesn't hit a 404.
   await searchService.ensureCollection();
 
-  // Health check route
+  // Auth: optional MUZICK_API_KEY / MUZICK_ADMIN_KEY
+  const apiKey = process.env.MUZICK_API_KEY;
+  const adminKey = process.env.MUZICK_ADMIN_KEY;
+  fastify.addHook('onRequest', async (request, reply) => {
+    if (!apiKey && !adminKey) return;
+    const path = request.url;
+    if (path === '/api/health') return;
+    const auth = request.headers.authorization || '';
+    const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
+    if (!token) return reply.code(401).send({ error: 'Unauthorized' });
+    // admin routes require admin key specifically
+    if (path.startsWith('/api/admin/') && adminKey) {
+      if (token !== adminKey) return reply.code(403).send({ error: 'Admin access denied' });
+      return;
+    }
+    // regular routes accept either key
+    if (token === apiKey || (adminKey && token === adminKey)) return;
+    reply.code(401).send({ error: 'Unauthorized' });
+  });
 
   fastify.get('/api/health', async (request, reply) => {
     const status = {