fix: remove basic auth from ui and bump version to 3.0.2

site/routes/pipeline_bp.py

@@ -1,6 +1,7 @@
 """Pipeline blueprint — SSE-сравнение + classify."""
-import hashlib, json, re, os, threading, time
+import hashlib, hmac, json, re, os, threading, time
 from flask import Blueprint, request, jsonify, Response, stream_with_context
+from config import API_KEY
 from services.process import run_pipeline
 from services import extractor as stateless_extractor
 from services.engine import analyze_batch
@@ -143,6 +144,11 @@ def engine_analyze_route():
     supplies parsed elements only; extraction passports and dossier decisions
     are always produced by the in-process Engine and persisted by its adapters.
     """
+    if not API_KEY:
+        return jsonify(ok=False, error="engine API is not configured"), 503
+    supplied_key = request.headers.get("X-API-Key", "")
+    if not hmac.compare_digest(supplied_key.encode("utf-8"), API_KEY.encode("utf-8")):
+        return jsonify(ok=False, error="unauthorized"), 401
     if _engine_rate_limited():
         return jsonify(ok=False, error="rate limit exceeded"), 429, {"Retry-After": "60"}