fix(ci): pull LFS model in python job; enable dev-key flag in auth test

- python CI checked out the model.onnx LFS pointer (not the real file),
  causing onnxruntime INVALID_PROTOBUF; add lfs: true to checkout.
- test_predict_json_accepts_dev_key now sets CLIMATEVISION_ALLOW_DEV_KEY=1
  to match the gated cv_dev bypass.

Author: obielin

.github/workflows/ci.yml

@@ -11,6 +11,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          lfs: true
 
       - name: Set up Python
         uses: actions/setup-python@v5

tests/test_api.py

@@ -25,8 +25,15 @@ def test_predict_json_rejects_missing_auth(client: TestClient) -> None:
     assert "API key required" in response.json()["detail"]
 
 
-def test_predict_json_accepts_dev_key(client: TestClient) -> None:
-    """POST /api/predict should accept the cv_dev development key."""
+def test_predict_json_accepts_dev_key(
+    client: TestClient, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """POST /api/predict should accept the cv_dev development key.
+
+    The dev bypass is gated behind CLIMATEVISION_ALLOW_DEV_KEY, so enable it
+    explicitly for this test (production leaves it unset/disabled).
+    """
+    monkeypatch.setenv("CLIMATEVISION_ALLOW_DEV_KEY", "1")
     payload = {
         "bbox": [-60.0, -15.0, -45.0, -5.0],
         "start_date": "2023-01-01",