Review for regression and safety.
- Check that the auth flow is additive only
- Confirm no breaking changes to existing auth endpoints
- Review error handling for any unhandled promise / exception risk
- Flag any remaining duplication in validateApiKey implementations or auth branches