feat: add optional bearer token authentication

[russellb]

Thanks for the project! I wanted to use it, but decided to run my own instance to avoid potential overuse of yours. Since I'm running my own, I wanted to put some basic authentication in place, so I made this addition to support configuring 1 or more API tokens. If the API_TOKENS env var is not set, the behavior is unchanged.

---

Implement API token authentication using FastAPI's built-in security utilities. When the API_TOKENS environment variable is set, all API endpoints require a valid bearer token.

Implementation details:

• New src/auth.py module handles token validation
• Uses FastAPI's HTTPBearer security scheme for OpenAPI integration
• API_TOKENS env var accepts comma-separated list of valid tokens
• Uses secrets.compare_digest for constant-time token comparison to prevent timing attacks
• Returns 401 with WWW-Authenticate header on auth failure
• When API_TOKENS is not set or empty, authentication is disabled (backwards compatible)
• Applied as global dependency, protecting all API routes
• /docs endpoint remains accessible for API documentation

Usage:

• Without auth (development) uvicorn src.api:app --reload

• With auth (production) API_TOKENS="token1,token2" uvicorn src.api:app

• Making authenticated requests curl -H "Authorization: Bearer token1" http://localhost:8000/top_players/

🤖 Generated with Claude Code

[vercel]

@russellb is attempting to deploy a commit to the cassiofbdev's projects Team on Vercel.

A member of the Team first needs to authorize it.