fix(gate): accept x-ael-key alongside x-respite-key; drop dead key read

The Respite -> Ael rename renamed the app's copy of the shared-key header to
X-Ael-Key while this gate kept reading x-respite-key. Those are different
header *names*, so every protected request was rejected with 401 from a
perfectly correct key — search and audio, on every deployment, silently.
Header names are case-insensitive, so the rename looked harmless in review;
it was not. c9fb4ed already restarted the Space so SEARX_API_KEY is loaded,
which is why the only remaining fault was the header name.

- Accept either spelling, x-respite-key first as canonical. The app now sends
the canonical one; the alias keeps any build in flight during a rename from
401ing, and must not be dropped without checking deployed builds.
- Drop the module-level _SPACE_KEY read of "RESpite_SPACE_KEY" — a
case-mangled secret name that never existed and always read "". It was masked
because the middleware rebinds the same name per request, so the broken read
was dead code one deleted line away from every gated route answering 503.
- Extract _is_protected() so the prefix check exists once. str.startswith takes
a tuple here; an equivalent transcription written with an array silently
matches nothing, which is exactly how the first draft of the app-side test
passed while testing nothing.

app.py

@@ -901,10 +901,19 @@ def _patched_create_app(blocks, **kwargs):
     try:
         import hmac as _hmac
 
-        _SPACE_KEY = os.environ.get("RESpite_SPACE_KEY", "")
+        # NOTE: there used to be a module-level
+        #   _SPACE_KEY = os.environ.get("RESpite_SPACE_KEY", "")
+        # here — a case-mangled name left by the Respite -> Ael rename, reading
+        # a secret that does not exist, so it always yielded "". It looked
+        # harmless because the middleware rebinds `_SPACE_KEY` from
+        # `_expected_key(path)` on every protected request, making the broken
+        # read dead. It was one deleted line away from every gated route
+        # answering 503 "service not configured" with nothing to say why. The key
+        # is now read in exactly one place.
+        #
         # Which secret guards which prefix. The searx bridge gets its own key
         # (SEARX_API_KEY) so rotating search access never touches the audio
-        # path; everything else shares RESPIRE_SPACE_KEY.
+        # path; everything else shares RESPITE_SPACE_KEY.
         _PROTECTED_PREFIXES = (
             "/respite/audio/",
             "/respite/search",
@@ -921,15 +930,36 @@ def _patched_create_app(blocks, **kwargs):
                 return os.environ.get("SEARX_API_KEY", "")
             return os.environ.get("RESPIRE_SPACE_KEY", "")
 
+        # The header the shared key is presented in. `x-respite-key` is
+        # canonical and is what the app sends; `x-ael-key` is accepted as an
+        # alias because the app was renamed Respite -> Ael and briefly sent
+        # `X-Ael-Key`, a header this gate never read — so every search and audio
+        # call 401'd for days. Header names are case-insensitive, so the alias
+        # is the same token in lower case; the real fault was that `x-ael-key`
+        # and `x-respite-key` are different *names* and the two sides drifted.
+        # Accepting both keeps any build in flight during a rename working. Do
+        # not drop the alias without checking that no deployed build still sends
+        # it.
+        _KEY_HEADERS = ("x-respite-key", "x-ael-key")
+
+        def _is_protected(path: str) -> bool:
+            return any(path.startswith(p) for p in _PROTECTED_PREFIXES)
+
         @fa_app.middleware("http")
         async def _respite_key_gate(request, call_next):
-            if request.url.path.startswith(_PROTECTED_PREFIXES):
+            if _is_protected(request.url.path):
                 _SPACE_KEY = _expected_key(request.url.path)
                 if not _SPACE_KEY:
                     return JSONResponse(
                         {"error": "service not configured"}, status_code=503
                     )
-                presented = request.headers.get("x-respite-key", "")
+                # Either spelling satisfies the gate; the first present wins.
+                presented = ""
+                for _h in _KEY_HEADERS:
+                    _v = request.headers.get(_h)
+                    if _v:
+                        presented = _v
+                        break
                 if not _hmac.compare_digest(presented, _SPACE_KEY):
                     return JSONResponse({"error": "unauthorized"}, status_code=401)
             return await call_next(request)