Use LLAMA_API_KEY (not gateway's own API_KEY) to authenticate to llama-server

The previous fix reused the gateway's own API_KEY secret, but that's
unset on this Space and, more fundamentally, is the wrong secret:
llama.cpp maps --api-key to the env var LLAMA_API_KEY specifically
(not the generic LLAMA_ARG_* pattern used for other flags), and this
Space already has a LLAMA_API_KEY secret configured for llama-server
that nothing was wiring up. Read that env var directly and attach it
to every gateway -> llama-server request instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XvAfE7bsSLrQm1VVBswYnx

gateway.py

@@ -22,6 +22,7 @@ DEFAULT_LANGUAGE = os.getenv("DEFAULT_LANGUAGE", "en")
 MAX_QUEUE_SIZE = int(os.getenv("MAX_QUEUE_SIZE", "32"))
 REQUEST_TIMEOUT = float(os.getenv("REQUEST_TIMEOUT_SECONDS", "900"))
 API_KEY = os.getenv("API_KEY", "").strip()
+LLAMA_API_KEY = os.getenv("LLAMA_API_KEY", "").strip()
 ENGLISH_GUARD = (
     "Respond entirely in English unless the user explicitly requests another "
     "language. Preserve code, identifiers, and quoted source material exactly."
@@ -123,7 +124,13 @@ async def wait_for_llama() -> None:
 
 
 def llama_auth_headers() -> dict[str, str]:
-    return {"Authorization": f"Bearer {API_KEY}"} if API_KEY else {}
+    # llama-server reads its own API key from the LLAMA_API_KEY env var
+    # (llama.cpp maps --api-key to that specific name, not the generic
+    # LLAMA_ARG_* pattern), independently of this gateway's own API_KEY.
+    # The gateway holds the same secret (it's set on the whole
+    # container), so attach it on every request we make to llama-server
+    # rather than relying on whatever the external caller supplied to us.
+    return {"Authorization": f"Bearer {LLAMA_API_KEY}"} if LLAMA_API_KEY else {}
 
 
 async def execute_completion(payload: dict[str, Any]) -> dict[str, Any]: