feat: four super-admin keys and production customer API security

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend-dapp/src/config/dex.ts

@@ -41,10 +41,11 @@ export function exchangeApi(path: string): string {
   return proxiedServiceUrl(DBIS_EXCHANGE_URL, '/api/v1/exchange', path);
 }
 
-/** Bearer auth for OMNL mutating APIs (token load, transfers, swap settle). */
+/** Bearer auth for OMNL mutating APIs — production portals inject via nginx; never embed operator keys in browser. */
 export function omnlApiHeaders(json = true): Record<string, string> {
   const headers: Record<string, string> = {};
   if (json) headers['Content-Type'] = 'application/json';
+  if (import.meta.env.PROD) return headers;
   const key = import.meta.env.VITE_OMNL_API_KEY?.trim();
   if (key) headers.Authorization = `Bearer ${key}`;
   return headers;