feat: security(CORS/API key), OpenAI-compatible endpoint, Paperless hook indexing; .env support

server/security.py

@@ -0,0 +1,17 @@
+from __future__ import annotations
+
+import os
+from fastapi import Header, HTTPException
+
+
+API_KEY_ENV = "API_KEY"
+
+
+def require_api_key(x_api_key: str | None = Header(default=None)) -> None:
+    expected = os.getenv(API_KEY_ENV, "")
+    if not expected:
+        # No API key configured → allow
+        return
+    if not x_api_key or x_api_key != expected:
+        raise HTTPException(status_code=401, detail="invalid_api_key")
+