- Add COORDINATOR_API_KEY config option to orchestrator.config.ts - Include X-API-Key header in coordinator requests when configured - Log security warning if COORDINATOR_API_KEY not configured in production - Log security warning if coordinator URL uses HTTP in production - Add tests verifying API key inclusion in requests and warning behavior Refs #337