The backend master SIGNAL_API_KEY had leaked via two paths:
- baked into the public Vite bundle via VITE_SIGNAL_API_KEY (Vercel)
- hardcoded as a fallback in scripts/signal_e2e_test.py
The key has been rotated on Railway (old value now returns 401) and the
VITE_SIGNAL_API_KEY var removed from Vercel. This commit removes the two
code paths so the master key can never be re-baked or re-committed:
- signal-ui/src/lib/api.js: drop the X-API-Key fallback entirely; the
frontend now authenticates only with the signed-in user's Clerk token
- scripts/signal_e2e_test.py: read SIGNAL_API_KEY from env only; exit if unset
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
25f65326d4