feat: add header key auth as alternative to IP allowlist

.env.example

@@ -12,3 +12,9 @@ PROXY_SECRET=
 # Allowed source CIDRs (comma-separated), leave empty to allow all (dev mode)
 # Example: "10.0.0.0/8,172.16.0.0/12"
 ALLOWED_CIDR=
+
+# API key header: a request carrying this header bypasses the IP allowlist (IP OR key).
+# Set both or neither. Name: [A-Za-z0-9-], value: [A-Za-z0-9._~+/=-]. Only matters if ALLOWED_CIDR is set.
+# Generate value with: openssl rand -hex 32
+AUTH_HEADER_NAME=
+AUTH_HEADER_VALUE=