fix: cover API auth guard regressions

Maintainer edit: restore CI by updating serve/onboard tests, add auth/config coverage, and keep auth failures on the OpenAI-compatible error shape.

tests/test_openai_api.py

@@ -108,6 +108,25 @@ async def test_missing_messages_returns_400(aiohttp_client, app) -> None:
     assert resp.status == 400
 
 
+@pytest.mark.skipif(not HAS_AIOHTTP, reason="aiohttp not installed")
+@pytest.mark.asyncio
+async def test_api_key_protects_api_routes_but_not_health(aiohttp_client, mock_agent) -> None:
+    app = create_app(mock_agent, model_name="test-model", api_key="secret")
+    client = await aiohttp_client(app)
+
+    health = await client.get("/health")
+    missing = await client.get("/v1/models")
+    wrong = await client.get("/v1/models", headers={"Authorization": "Bearer wrong"})
+    ok = await client.get("/v1/models", headers={"Authorization": "Bearer secret"})
+
+    assert health.status == 200
+    assert missing.status == 401
+    assert wrong.status == 401
+    assert ok.status == 200
+    assert (await missing.json())["error"]["message"].startswith("Missing Authorization")
+    assert (await wrong.json())["error"]["message"] == "Invalid API key"
+
+
 @pytest.mark.skipif(not HAS_AIOHTTP, reason="aiohttp not installed")
 @pytest.mark.asyncio
 async def test_no_user_message_returns_400(aiohttp_client, app) -> None: