Add AI service API token auth

internal/httpapi/auth.go

@@ -0,0 +1,30 @@
+package httpapi
+
+import (
+	"crypto/subtle"
+	"net/http"
+	"strings"
+)
+
+func (s *Server) requireAPIToken(path string, r *http.Request) bool {
+	if !strings.HasPrefix(path, "/api/v1/") && path != "/api/v1" {
+		return true
+	}
+	expected := strings.TrimSpace(s.cfg.APIAuthToken)
+	if expected == "" {
+		return true
+	}
+	got := bearerToken(r.Header.Get("Authorization"))
+	if got == "" {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(got), []byte(expected)) == 1
+}
+
+func bearerToken(header string) string {
+	header = strings.TrimSpace(header)
+	if len(header) < len("Bearer ") || !strings.EqualFold(header[:len("Bearer ")], "Bearer ") {
+		return ""
+	}
+	return strings.TrimSpace(header[len("Bearer "):])
+}