Add internal API key rotation support

[chrismaz11]

Motivation

• Make internal operational endpoints resilient to key rotation by accepting multiple internal API keys.
• Preserve backward compatibility with the existing INTERNAL_API_KEY while enabling safer production operations.
• Fail closed on startup unless at least one internal key is configured to avoid accidental exposure.

Description

• Add optional INTERNAL_API_KEYS to the environment schema and implement parseInternalApiKeys to normalize, deduplicate, and validate a merged list from INTERNAL_API_KEY and INTERNAL_API_KEYS.
• Populate returned AppEnv with INTERNAL_API_KEY (first key) and INTERNAL_API_KEYS (string array) after parsing in parseEnv (src/config/env.ts).
• Update the internal auth middleware to accept a comma-separated list of configured keys and validate incoming tokens against each candidate using timing-safe comparison (src/routes/github.ts).
• Update tests to cover merged key parsing and middleware multi-key acceptance, and document the new INTERNAL_API_KEYS in .env.example and README.md.

Testing

• Ran the unit test suite with npm run test (Vitest), all tests passed (52 passed).
• Ran full validation with npm run validate (runs lint, typecheck, test, and build), which completed successfully.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fbbd279e99

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve full internal key list for router auth

Assigning INTERNAL_API_KEY to only internalApiKeys[0] means the rotated keys parsed from INTERNAL_API_KEYS are dropped for downstream consumers that still read the legacy field. In current wiring, createGitHubRouter calls createInternalApiKeyMiddleware(env.INTERNAL_API_KEY), so requests using any non-first rotated key are rejected even though startup accepted them, breaking the advertised key-rotation path in production.

Useful? React with 👍 / 👎.