Motivation

• Make internal operational endpoints resilient to key rotation by accepting multiple internal API keys.
• Preserve backward compatibility with the existing INTERNAL_API_KEY while enabling safer production operations.
• Fail closed on startup unless at least one internal key is configured to avoid accidental exposure.

Description

• Add optional INTERNAL_API_KEYS to the environment schema and implement parseInternalApiKeys to normalize, deduplicate, and validate a merged list from INTERNAL_API_KEY and INTERNAL_API_KEYS.
• Populate returned AppEnv with INTERNAL_API_KEY (first key) and INTERNAL_API_KEYS (string array) after parsing in parseEnv (src/config/env.ts).
• Update the internal auth middleware to accept a comma-separated list of configured keys and validate incoming tokens against each candidate using timing-safe comparison (src/routes/github.ts).
• Update tests to cover merged key parsing and middleware multi-key acceptance, and document the new INTERNAL_API_KEYS in .env.example and README.md.

Testing

• Ran the unit test suite with npm run test (Vitest), all tests passed (52 passed).
• Ran full validation with npm run validate (runs lint, typecheck, test, and build), which completed successfully.

Codex Task