fix(server): match b10621 multi-key authentication semantics #1437

Parent

• epic(server): close llama-server b10621 compatibility gaps #1431

Problem

llama-server b10621 accepts multiple API keys through a comma-separated --api-key, reads one key per line from --api-key-file while ignoring comments, and exempts a defined set of public endpoints. mlxcel currently compares one exact CLI value or the entire trimmed file as one key, so accepted syntax and authorization behavior diverge.

Scope

• Parse comma-separated --api-key values with whitespace handling matching b10621.
• Parse --api-key-file as one key per non-empty line and ignore comment lines according to upstream behavior.
• Support canonical environment bindings, including LLAMA_API_KEY and the b10621 API-key-file binding if present in the pinned manifest.
• Match bearer-token parsing, missing/invalid credential status codes, and response envelopes.
• Audit which health, metrics, props, models, and static endpoints remain public when authentication is enabled.
• Keep secret values out of help, logs, debug output, metrics, and error bodies.

Acceptance criteria

• Multiple CLI and file keys authenticate independently.
• Blank lines and comments do not become credentials.
• CLI, file, and environment precedence matches the pinned b10621 behavior.
• Public and protected route tests cover both /v1 and native aliases.
• Malformed authorization headers and unknown keys return compatible status codes without leaking configured keys.
• Existing single-key deployments remain valid.

Validation

• Add integration tests using temporary key files, multiple valid keys, an invalid key, missing credentials, and log capture with canary secrets.