Copy this file to `.apikey` and put a single secret token in it (no newline needed).
When `.apikey` exists, run.sh sets ROUTER_API_KEY and the router requires
`Authorization: Bearer <token>` on all /v1 requests.

If `.apikey` does NOT exist, the router runs OPEN (no auth) — fine on a trusted
LAN, NOT fine if you expose it to the internet.

Generate one:  openssl rand -hex 24