feat(auth): 调用秘钥鉴权——AUTH_KEY 环境变量启用，Bearer/X-Api-Key/?key= 三种携带方式，流地址自动附带 key

src/server.ts

@@ -80,6 +80,14 @@ fastify.addHook('onRoute', (routeOptions) => {
 
 fastify.register(cors, { origin: '*' })
 
+// ---- 调用秘钥（AUTH_KEY 环境变量启用；未设置则不鉴权）----
+// 详见 src/http/auth-gate.ts；文档/健康检查豁免，业务接口要求 Bearer / X-Api-Key / ?key=
+const authKey = process.env.AUTH_KEY
+if (authKey) {
+  const { registerAuth } = await import('./http/auth-gate.ts')
+  registerAuth(fastify, authKey)
+}
+
 fastify.addHook('onRequest', async(_request, reply) => {
   reply.header('Cache-Control', 'no-store')
 })
@@ -204,6 +212,7 @@ if (!useSource) {
 export const startServer = async(port = PORT) => {
   await fastify.listen({ port: Number(port), host: '0.0.0.0' })
   console.log(`音乐服务器已启动: http://localhost:${port}`)
+  console.log(`调用鉴权:   ${authKey ? `已启用（AUTH_KEY，Bearer / X-Api-Key / ?key=）` : '未启用（设置 AUTH_KEY 环境变量开启）'}`)
   console.log(`取流通道:   ${useSource ? '外部音源脚本（sources/，SOURCE_ENABLED）' : 'SDK 官方直连接口'}`)
   console.log(`接口文档:   http://localhost:${port}/docs (Swagger UI)`)
   console.log(`ReDoc 文档: http://localhost:${port}/redoc`)