fix(SEC-ORCH-2): Add API key authentication to orchestrator API

Add OrchestratorApiKeyGuard to protect agent management endpoints (spawn,
kill, kill-all, status) from unauthorized access. Uses X-API-Key header
with constant-time comparison to prevent timing attacks.

- Create apps/orchestrator/src/common/guards/api-key.guard.ts
- Add comprehensive tests for all guard scenarios
- Apply guard to AgentsController (controller-level protection)
- Document ORCHESTRATOR_API_KEY in .env.example files
- Health endpoints remain unauthenticated for monitoring

Security: Prevents unauthorized users from draining API credits or
killing all agents via unprotected endpoints.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/orchestrator/src/api/agents/agents.controller.ts

@@ -10,17 +10,23 @@ import {
   UsePipes,
   ValidationPipe,
   HttpCode,
+  UseGuards,
 } from "@nestjs/common";
 import { QueueService } from "../../queue/queue.service";
 import { AgentSpawnerService } from "../../spawner/agent-spawner.service";
 import { AgentLifecycleService } from "../../spawner/agent-lifecycle.service";
 import { KillswitchService } from "../../killswitch/killswitch.service";
 import { SpawnAgentDto, SpawnAgentResponseDto } from "./dto/spawn-agent.dto";
+import { OrchestratorApiKeyGuard } from "../../common/guards/api-key.guard";
 
 /**
  * Controller for agent management endpoints
+ *
+ * All endpoints require API key authentication via X-API-Key header.
+ * Set ORCHESTRATOR_API_KEY environment variable to configure the expected key.
  */
 @Controller("agents")
+@UseGuards(OrchestratorApiKeyGuard)
 export class AgentsController {
   private readonly logger = new Logger(AgentsController.name);
 

apps/orchestrator/src/api/agents/agents.module.ts

@@ -4,9 +4,11 @@ import { QueueModule } from "../../queue/queue.module";
 import { SpawnerModule } from "../../spawner/spawner.module";
 import { KillswitchModule } from "../../killswitch/killswitch.module";
 import { ValkeyModule } from "../../valkey/valkey.module";
+import { OrchestratorApiKeyGuard } from "../../common/guards/api-key.guard";
 
 @Module({
   imports: [QueueModule, SpawnerModule, KillswitchModule, ValkeyModule],
   controllers: [AgentsController],
+  providers: [OrchestratorApiKeyGuard],
 })
 export class AgentsModule {}