fix: cover API auth guard regressions

Maintainer edit: restore CI by updating serve/onboard tests, add auth/config coverage, and keep auth failures on the OpenAI-compatible error shape.

tests/config/test_config_load_errors.py

@@ -3,6 +3,7 @@ import json
 import pytest
 
 from nanobot.config.loader import load_config
+from nanobot.config.schema import ApiConfig
 
 
 def test_load_config_missing_file_uses_defaults(tmp_path) -> None:
@@ -28,3 +29,16 @@ def test_load_config_invalid_schema_fails_fast(tmp_path) -> None:
 
     with pytest.raises(ValueError, match="Failed to load config"):
         load_config(config_path)
+
+
+@pytest.mark.parametrize("host", ["0.0.0.0", "::"])
+def test_api_config_requires_key_for_wildcard_hosts(host: str) -> None:
+    with pytest.raises(ValueError, match="api_key is not set"):
+        ApiConfig(host=host)
+
+
+def test_api_config_allows_wildcard_host_with_key() -> None:
+    config = ApiConfig(host="0.0.0.0", api_key="secret")
+
+    assert config.host == "0.0.0.0"
+    assert config.api_key == "secret"