Add Qdrant vectorstore service, gateway API-key middleware, docs and .gitignore

gateway/main.py

@@ -5,7 +5,9 @@ import asyncio
 from typing import Any, Dict, Optional
 
 import httpx
-from fastapi import FastAPI, HTTPException, UploadFile, File, Form
+from fastapi import FastAPI, HTTPException, UploadFile, File, Form, Request
+from fastapi.responses import JSONResponse
+from starlette.middleware.base import BaseHTTPMiddleware
 from pydantic import BaseModel, Field
 
 CLIP_URL = os.getenv("CLIP_URL", "http://clip:8000")
@@ -14,7 +16,21 @@ YOLO_URL = os.getenv("YOLO_URL", "http://yolo:8000")
 QDRANT_SVC_URL = os.getenv("QDRANT_SVC_URL", "http://qdrant-svc:8000")
 VISION_TIMEOUT = float(os.getenv("VISION_TIMEOUT", "20"))
 
+# API key (set via env var `API_KEY`). If not set, gateway will reject requests.
+API_KEY = os.getenv("API_KEY")
+
+class APIKeyMiddleware(BaseHTTPMiddleware):
+    async def dispatch(self, request: Request, call_next):
+        # allow health and docs endpoints without API key
+        if request.url.path in ("/health", "/openapi.json", "/docs", "/redoc"):
+            return await call_next(request)
+        key = request.headers.get("x-api-key") or request.headers.get("X-API-Key")
+        if not API_KEY or key != API_KEY:
+            return JSONResponse(status_code=401, content={"detail": "Unauthorized"})
+        return await call_next(request)
+
 app = FastAPI(title="Skinbase Vision Gateway", version="1.0.0")
+app.add_middleware(APIKeyMiddleware)
 
 
 class ClipRequest(BaseModel):