M2M service account authentication via API key

[burkkyy]

Context

YRHP requires access to YHSI api without a user login session.

Implementation

• Added SERVICE_ACCOUNT_KEY env var — when set, enables M2M authentication
• SERVICE_ACCOUNT_KEY unset (or empty) disables M2M entirely

Usage

1. Generate a key and set it in the environment:

   openssl rand -hex 32

   In .env:

   SERVICE_ACCOUNT_KEY=<generated key>

2. On each request add key to x-api-key header. Example usage:

curl https://your-api/api/place -H "x-api-key: <key>"

Change Request: Seed Service Account

A user with email service@yhsi.internal and status Active must exist in the database before M2M requests will work. Assign it the roles appropriate for the consuming application.