security: require a shared service key on /tts and /extract-resume

Both compute endpoints were reachable by anyone who knew the Space URL.
require_service_key checks x-service-key with hmac.compare_digest and fails
closed when SERVICE_API_KEY is unset. /health stays open for platform probes.

SERVICE_API_KEY is set on this Space and the backend already sends it.

routers/extraction.py

@@ -1,11 +1,12 @@
 import io
-from fastapi import APIRouter, HTTPException, File, UploadFile
+from fastapi import APIRouter, Depends, HTTPException, File, UploadFile
+from services.auth import require_service_key
 from services.pdf_extractor import extract_docx_from_stream, extract_resume_from_stream
 
 router = APIRouter(prefix="/extract-resume", tags=["extraction"])
 
 
-@router.post("")
+@router.post("", dependencies=[Depends(require_service_key)])
 async def extract_resume(file: UploadFile = File(...)):
     """
     Receives an uploaded PDF file stream, extracts and structures its text,

routers/tts.py

@@ -1,9 +1,10 @@
 from typing import Literal
 
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, Depends, HTTPException
 from fastapi.responses import Response
 from pydantic import BaseModel, Field
 
+from services.auth import require_service_key
 from services.tts_service import synthesize, is_available, backend_status
 
 router = APIRouter(prefix="/tts", tags=["tts"])
@@ -23,7 +24,7 @@ def tts_health():
     return {"available": is_available(), "backend": backend_status()}
 
 
-@router.post("")
+@router.post("", dependencies=[Depends(require_service_key)])
 def tts(req: TtsRequest):
     """
     Synthesize interviewer speech with Kokoro. Returns audio (WAV or Ogg/Opus)

services/auth.py

@@ -0,0 +1,27 @@
+import hmac
+import os
+
+from fastapi import Header, HTTPException
+
+
+def require_service_key(x_service_key: str | None = Header(default=None)) -> None:
+    """
+    Shared-secret gate for the compute endpoints (/extract-resume, /tts).
+
+    This service is only ever called by the NestJS backend, but on a public host
+    it is reachable by anyone — without this, the TTS and extraction compute is
+    free for whoever finds the URL.
+
+    Fails closed: if SERVICE_API_KEY is unset the endpoints refuse traffic
+    rather than running open, so a missing env var can't silently expose them.
+    Health checks stay unauthenticated so platform probes keep working.
+    """
+    expected = os.getenv("SERVICE_API_KEY")
+    if not expected:
+        raise HTTPException(
+            status_code=503,
+            detail="Service authentication is not configured.",
+        )
+    # compare_digest avoids leaking the key through response timing.
+    if not x_service_key or not hmac.compare_digest(x_service_key, expected):
+        raise HTTPException(status_code=401, detail="Invalid or missing service key.")