fix: valid key header bypasses both IP allowlist and PROXY_SECRET check

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docker-entrypoint.sh

@@ -22,7 +22,7 @@ if [ -z "${ACME_EMAIL}" ]; then
     exit 1
 fi
 
-# --- 1. API key header (optional bypass of the IP allowlist) ---
+# --- 1. API key header (optional: bypasses both the IP allowlist and the token check) ---
 KEY_MATCH=""
 if [ -n "${AUTH_HEADER_NAME}" ] || [ -n "${AUTH_HEADER_VALUE}" ]; then
     if [ -z "${AUTH_HEADER_NAME}" ] || [ -z "${AUTH_HEADER_VALUE}" ]; then
@@ -67,12 +67,15 @@ GUARDRULE
     echo "[entrypoint] IP allowlist configured: ${CIDR_LIST}"
 fi
 
-# --- 3. Token auth (legacy, applied in addition to the checks above) ---
+# --- 3. Token auth (legacy X-Proxy-Token; a valid key header also satisfies it) ---
 if [ -z "${PROXY_SECRET}" ]; then
     echo "[entrypoint] PROXY_SECRET is not set — token auth disabled (open mode)"
 else
     cat >> "${MATCHERS}" <<MATCH
-@bad_token not header X-Proxy-Token "${PROXY_SECRET}"
+@bad_token {
+	not header X-Proxy-Token "${PROXY_SECRET}"
+	${KEY_MATCH}
+}
 MATCH
     cat >> "${GUARD}" <<GUARDRULE
 respond @bad_token \`{"error":"invalid_token"}\` 403 {