feat: four super-admin keys and production customer API security

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/nginx/omnl-common-locations.conf

@@ -1,6 +1,7 @@
 # Shared OMNL Bank proxy locations (include inside each server block)
 
 location /api/v1/ {
+    include /etc/nginx/omnl-portal-auth-current.conf.inc;
     proxy_pass http://omnl_api/api/v1/;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
@@ -11,6 +12,7 @@ location /api/v1/ {
 }
 
 location /settlement/ {
+    include /etc/nginx/omnl-portal-auth-current.conf.inc;
     proxy_pass http://omnl_settlement/api/v1/settlement/;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
@@ -22,6 +24,7 @@ location /settlement/ {
 }
 
 location /exchange/ {
+    include /etc/nginx/omnl-portal-auth-current.conf.inc;
     proxy_pass http://omnl_exchange/api/v1/exchange/;
     proxy_http_version 1.1;
     proxy_set_header Host $host;

deploy/nginx/omnl-lxc-portal.conf

@@ -33,6 +33,7 @@ http {
     index index.html;
 
     location /api/v1/ {
+      include /srv/zardasht-portal/deploy/nginx/omnl-portal-auth-current.conf.inc;
       proxy_pass http://omnl_lxc_api/api/v1/;
       proxy_http_version 1.1;
       proxy_set_header Host $host;
@@ -40,6 +41,7 @@ http {
     }
 
     location /settlement/ {
+      include /srv/zardasht-portal/deploy/nginx/omnl-portal-auth-current.conf.inc;
       proxy_pass http://omnl_lxc_settlement/api/v1/settlement/;
       proxy_http_version 1.1;
       proxy_set_header Host $host;
@@ -47,6 +49,7 @@ http {
     }
 
     location /exchange/ {
+      include /srv/zardasht-portal/deploy/nginx/omnl-portal-auth-current.conf.inc;
       proxy_pass http://omnl_lxc_exchange/api/v1/exchange/;
       proxy_http_version 1.1;
       proxy_set_header Host $host;

deploy/nginx/omnl-portal-auth-current.conf.inc.example

@@ -0,0 +1,3 @@
+# Copy to /etc/nginx/omnl-portal-auth-current.conf.inc on deploy (generated with real secrets).
+# proxy_set_header Authorization "Bearer <super-admin-key>";
+# proxy_set_header X-OMNL-Portal-Auth "<internal-secret>";