fix: valid key header bypasses both IP allowlist and PROXY_SECRET check

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.example

@@ -13,7 +13,7 @@ PROXY_SECRET=
 # Example: "10.0.0.0/8,172.16.0.0/12"
 ALLOWED_CIDR=
 
-# API key header: a request carrying this header bypasses the IP allowlist (IP OR key).
+# API key header: a request carrying this header bypasses both the IP allowlist and PROXY_SECRET check.
 # Set both or neither. Name: [A-Za-z0-9-], value: [A-Za-z0-9._~+/=-]. Only matters if ALLOWED_CIDR is set.
 # Generate value with: openssl rand -hex 32
 AUTH_HEADER_NAME=