Add AI service API token auth

README.md

@@ -60,12 +60,17 @@ or compact `system` / `user` fields. The completed job result contains
 - `GET /healthz` returns process health.
 - `GET /readyz` checks PostgreSQL readiness.
 
+All `/api/v1/*` endpoints require `Authorization: Bearer <AI_SERVICE_TOKEN>`
+when `AI_SERVICE_TOKEN` is configured. Health and readiness endpoints stay open
+for Kubernetes probes.
+
 ## Configuration
 
 - `HTTP_HOST`, default `0.0.0.0`
 - `HTTP_PORT`, default `8080`
 - `DATABASE_URL`, required
 - `MIGRATE_ON_START`, default `true`
+- `AI_SERVICE_TOKEN`, optional bearer token for service-to-service API calls
 - `LLM_BASE_URL`, primary OpenAI-compatible LLM endpoint
 - `LLM_API_KEY`, primary LLM API key
 - `LLM_MODEL`, default `qwen2.5-14b`