fix: replace hardcoded API key with secure random token

[Lidang-Jiang]

Summary

The vLLM server was initialized with api_key="default" (CWE-798), allowing unauthenticated access with a well-known credential. Any user with network access could bypass authentication using Authorization: Bearer default.

Fix: Replace hardcoded "default" with _generate_api_key() that:

• Uses secrets.token_urlsafe(32) for a cryptographically random token
• Supports ART_API_KEY env var for operators who need a pinned credential
• Updated all 4 call sites: openai_server.py, local/backend.py, tinker_native/backend.py, tinker/server.py

Fixes #628

Before

# src/art/dev/openai_server.py line 30
server_args = ServerArgs(
    api_key="default",  # Well-known credential — anyone can authenticate
    ...
)

# PoC: unauthorized access succeeds
$ curl -s http://target:8000/v1/models -H "Authorization: Bearer default"
{"object": "list", "data": [{"id": "Qwen/Qwen1.5-0.5B", ...}]}

After

# src/art/dev/openai_server.py
def _generate_api_key() -> str:
    import os, secrets
    return os.environ.get("ART_API_KEY") or secrets.token_urlsafe(32)

server_args = ServerArgs(
    api_key=_generate_api_key(),  # Unique random token per invocation
    ...
)

# PoC: "default" no longer works
$ curl -i http://target:8000/v1/models -H "Authorization: Bearer default"
HTTP/1.1 401 Unauthorized

$ pytest tests/unit/test_api_key_generation.py -v
PASSED test_key_is_not_hardcoded_default
PASSED test_key_has_sufficient_entropy
PASSED test_keys_are_unique_across_calls
PASSED test_env_var_override
PASSED test_env_var_empty_falls_back_to_random
PASSED test_config_key_is_not_default
PASSED test_config_uses_env_var
... 12 passed

Test plan

• 12 unit tests for API key generation and config integration
• Verified "default" string no longer appears in any api_key= assignment