[jay23606]

What

An opt-in shared bearer token for the /v1/* routes, so small deployments can stop GET /v1/capabilities/:holder from answering anyone who reaches the port, without a reverse proxy.

• KEYGATE_API_TOKENS is a comma-separated list, validated in src/config.ts through ConfigSchema. Empty entries and tokens shorter than 32 characters are reported with the other config errors.
• When set, every /v1/* route requires Authorization: Bearer <token>. A missing or wrong token gets 401 {"error":"unauthorized"} with www-authenticate: Bearer.
• Tokens are compared with crypto.timingSafeEqual on SHA-256 digests, so the comparison does not depend on the length of the presented value. Every configured token is checked even after a match.
• /healthz and /readyz stay unauthenticated.
• Nothing logs the token or the authorization header.
• When the variable is unset, behaviour is unchanged.
• .env.example, the README configuration section and SECURITY.md item 5 are updated to match.

Tests

• test/config.test.ts: a valid list, an empty entry, and a short token.
• test/server.test.ts: no header, wrong token, a right token from a list, health routes open, and no tokens configured.

Checks run locally:

• npx vitest run: 129 passed
• npx tsc --noEmit: clean
• npx eslint src test: clean
• npx prettier --check src test: clean

Regression test: untested: a small feature has no test that fails before the change

Fixes #3