feat: enforce strict Bearer Token auth for HF Space interactions

app.py

@@ -167,8 +167,12 @@ async def vault_media(request: VaultRequest, background_tasks: BackgroundTasks,
     return {"status": "accepted", "message": "Vaulting started"}
 
 @app.get("/proxy-stream/{file_id}")
-async def proxy_stream(file_id: str, type: str = "audio", secret: str = Header(None)):
-    if secret != SECRET_TOKEN:
+async def proxy_stream(file_id: str, type: str = "audio", authorization: str = Header(None)):
+    if not authorization or not authorization.startswith("Bearer "):
+        raise HTTPException(status_code=401, detail="Unauthorized")
+    
+    token = authorization.split(" ")[1]
+    if token != SECRET_TOKEN:
         raise HTTPException(status_code=401, detail="Unauthorized")
 
     async def stream_generator():