feat(api): add API key authentication to backend endpoints

Add API key security using fastapi.security.APIKeyHeader to protect /v1/completions and /v1/ocr endpoints. Updated frontend to include X-API-Key header in API requests. Also changed default API base URL from http://149.104.29.239:8001 to https://api.learnteach.tech:8002.

backend/main.py

@@ -1,4 +1,5 @@
-from fastapi import FastAPI, Request
+from fastapi import FastAPI, Request, HTTPException, Security
+from fastapi.security import APIKeyHeader
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import StreamingResponse, JSONResponse
 from pydantic import BaseModel
@@ -27,6 +28,17 @@ app.add_middleware(
     allow_headers=["*"],
 )
 
+API_KEY = "your-secret-key-here"  # 建议从环境变量读取
+api_key_header = APIKeyHeader(name="X-API-Key")
+
+async def get_api_key(api_key: str = Security(api_key_header)):
+    if api_key != API_KEY:
+        raise HTTPException(
+            status_code=403,
+            detail="Could not validate credentials"
+        )
+    return api_key
+
 from typing import Optional
 
 class UserPreferences(BaseModel):
@@ -58,7 +70,7 @@ def get_client_ip(request: Request) -> str:
     return request.headers.get("X-Client-IP") or request.client.host if request.client else "unknown"
 
 @app.post("/v1/completions")
-async def create_completion(request: Request, req: CompletionRequest):
+async def create_completion(request: Request, req: CompletionRequest, api_key: str = Security(get_api_key)):
     request_id = str(uuid.uuid4())[:8]
     
     client_ip = "hidden"
@@ -122,7 +134,7 @@ async def create_completion(request: Request, req: CompletionRequest):
         return JSONResponse(content={"error": str(e)}, status_code=500)
 
 @app.post("/v1/ocr")
-async def ocr_image(request: OCRRequest):
+async def ocr_image(request: OCRRequest, api_key: str = Security(get_api_key)):
     request_id = str(uuid.uuid4())[:8]
     try:
         logger.info(