Fix binding token extraction and harden startup concurrency

app/core/security.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import hashlib
 import hmac
 from datetime import UTC, datetime, timedelta
+from typing import Mapping
 
 from fastapi import HTTPException, status
 from jose import JWTError, jwt
@@ -34,6 +35,19 @@ def extract_bearer_token(authorization: str | None) -> str | None:
     return token.strip()
 
 
+def extract_request_token(headers: Mapping[str, str]) -> tuple[str | None, str | None]:
+    bearer_token = extract_bearer_token(headers.get("authorization"))
+    if bearer_token:
+        return bearer_token, "authorization"
+
+    for header_name in ("x-api-key", "api-key"):
+        header_value = headers.get(header_name)
+        if header_value and header_value.strip():
+            return header_value.strip(), header_name
+
+    return None, None
+
+
 def verify_admin_password(password: str, settings: Settings) -> bool:
     return hmac.compare_digest(password, settings.admin_password)