8.1 ApiKeyMiddleware

Enforce X-Api-Key on /api/* requests with constant-time comparison.
/i/{mac}.png and /health remain unauthenticated. No-op when the
configured key is empty.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

IMPLEMENTATION.md

@@ -187,14 +187,14 @@ Each type lives in `src/FrameProcessor/Domain/`. Tests in `tests/FrameProcessor.
 - Fetch → pipeline → store → publish. Same response shape as 5.1.
 - Map `ImageFetchException` to `502 Bad Gateway`.
 
-### [ ] 7.3 Manual check
+### [x] 7.3 Manual check
 - `curl -H "Content-Type: application/json" -d '{"url":"https://..."}' .../image-url` works end-to-end.
 
 ---
 
 ## Phase 8 — Auth + concurrency + robustness
 
-### [ ] 8.1 `ApiKeyMiddleware`
+### [x] 8.1 `ApiKeyMiddleware`
 - Matches request path `/api/*`; reads `X-Api-Key` header; constant-time compare against `ApiKeyOptions` only if `ApiKeyOptions`is set to non-empty.
 - 401 on mismatch. `/i/{mac}.png` and `/health` unaffected.