fix: read the shared secret per request; add a names-only env diagnostic

app.py

@@ -912,6 +912,7 @@ def _patched_create_app(blocks, **kwargs):
         @fa_app.middleware("http")
         async def _respite_key_gate(request, call_next):
             if request.url.path.startswith(_PROTECTED_PREFIXES):
+                _SPACE_KEY = os.environ.get("RESPIRE_SPACE_KEY", "")
                 if not _SPACE_KEY:
                     return JSONResponse(
                         {"error": "service not configured"}, status_code=503
@@ -921,7 +922,7 @@ def _patched_create_app(blocks, **kwargs):
                     return JSONResponse({"error": "unauthorized"}, status_code=401)
             return await call_next(request)
 
-        _log(f"compute routes key gate installed (key {'set' if _SPACE_KEY else 'MISSING'})")
+        _log("compute routes key gate installed")
     except Exception as _ke:
         _log(f"compute routes key gate FAILED to install: {_ke}")
 
@@ -954,6 +955,14 @@ def _patched_create_app(blocks, **kwargs):
     except Exception as _ce:
         _log(f"respite CORS gate not installed: {_ce}")
 
+    @fa_app.get("/respite/_envcheck")
+    def _envcheck():
+        """TEMPORARY diagnostic. Reports whether expected env NAMES are
+        present in the container. Values are never included. Removed once
+        the cause of the missing secret is confirmed."""
+        names = ["RESPIRE_SPACE_KEY", "GOOGLE_API_KEY", "PUBLICAI_API_KEY", "HF_TOKEN", "SPACE_ID"]
+        return JSONResponse({n: bool(os.environ.get(n)) for n in names})
+
     _log("Routes injected via create_app monkey-patch")
     return fa_app