[Senate] Implement authentication on POST /api/debate/trigger endpoint

[Senate] Implement authentication on POST /api/debate/trigger endpoint

ID: f6b0ff49-db9 Priority: 95 Type: one_shot Status: open

Goal

Critical: POST /api/debate/trigger has no authentication (C-5). Anyone can create debates causing DoS and cost amplification. Implement API key authentication using FastAPI Depends and Header. Add SCIDEX_API_KEY env var check. See security_audit_2026-04-02.md for implementation example.

Acceptance Criteria

Work Log

2026-04-13 21:30 PT — Slot 56

• Implemented API key authentication on POST /api/debate/trigger endpoint
• Added verify_api_key function using FastAPI Depends and Header pattern from security_audit_2026-04-02.md
• Checks SCIDEX_API_KEY environment variable; logs warning if unset (backwards compatible)
• Returns 401 if API key doesn't match
• Added Header import to fastapi imports
• Syntax check passed
• Committed and pushed