security: move API keys to env var, strip from source code fallback

- Added API_KEYS env var to router service in docker-compose.yml
- Replaced hardcoded agent keys in router.py fallback with dev-only placeholder
- Production now loads keys from environment, not source code
- Resolves the final remaining item from CT116 security deep-dive

Co-authored-by: Abiba via Kwame

router/router.py

@@ -36,18 +36,10 @@ TIER_MODELS = {
     "professional": ["qwen3.6-35B-A3B", "qwen3.6-27B-code", "qwen3.5-9b-vlm"],
     "enterprise": ["qwen3.6-35B-A3B", "qwen3.6-27B-code", "qwen3.5-9b-vlm"],
 }
-# API keys loaded from env var (JSON string) with hardcoded fallback for dev
-# Set API_KEYS env var in docker-compose.yml to override
+# API keys loaded from API_KEYS env var (set in docker-compose.yml)
+# Fallback is dev-only — production MUST set API_KEYS env var
 API_KEYS = json.loads(os.environ.get("API_KEYS", json.dumps({
-    "sk-syslog-local-master-key": {"tier": "enterprise", "agent": "admin"},
-    "sk-syslog-abiba": {"tier": "enterprise", "agent": "Abiba"},
-    "sk-syslog-mumuni": {"tier": "enterprise", "agent": "Mumuni"},
-    "sk-syslog-tanko": {"tier": "enterprise", "agent": "Tanko"},
-    "sk-syslog-koby": {"tier": "enterprise", "agent": "Koby"},
-    "sk-syslog-kagenz0": {"tier": "enterprise", "agent": "Kagenz0"},
-    "sk-syslog-koonimo": {"tier": "enterprise", "agent": "Koonimo"},
-    "sk-starter-abc123": {"tier": "starter", "agent": "test-starter"},
-    "sk-professional-xyz789": {"tier": "professional", "agent": "test-pro"},
+    "sk-dev-local-only": {"tier": "enterprise", "agent": "dev"},
 })))
 # Rate limits: requests per minute per API key tier
 RATE_LIMIT_RPM = {