feat: four super-admin keys and production customer API security

Co-authored-by: Cursor <cursoragent@cursor.com>

services/token-aggregation/src/api/middleware/omnl-guards.ts

@@ -1,4 +1,5 @@
 import type { Request, Response, NextFunction } from 'express';
+import { resolveOmnlPrincipal } from '@dbis/integration-foundation';
 
 function extractBearerOrQuery(req: Request, key: string): boolean {
   const auth = String(req.headers.authorization || '');
@@ -9,6 +10,8 @@ function extractBearerOrQuery(req: Request, key: string): boolean {
 }
 
 function hasOmnlOperatorAuth(req: Request): boolean {
+  const principal = resolveOmnlPrincipal(req);
+  if (principal && principal.role !== 'customer') return true;
   const apiKey = process.env.OMNL_API_KEY?.trim();
   if (apiKey && extractBearerOrQuery(req, apiKey)) return true;
   const dashKey = process.env.OMNL_DASHBOARD_TOKEN?.trim();
@@ -69,18 +72,14 @@ export function omnlRequireApiKeyInProduction(req: Request, res: Response, next:
     return;
   }
   const key = process.env.OMNL_API_KEY?.trim();
-  if (!key) {
+  if (!key && !process.env.OMNL_SUPER_ADMIN_OFFICE24_KEY) {
     res.status(503).json({
-      error: 'OMNL_API_KEY required in production',
-      hint: 'Set OMNL_API_KEY and pass Authorization: Bearer <key>',
+      error: 'OMNL super-admin API keys required in production',
+      hint: 'Run scripts/deployment/seed-omnl-super-admin-keys.sh',
     });
     return;
   }
-  if (extractBearerOrQuery(req, key)) {
-    next();
-    return;
-  }
-  if (isComplianceConsolePath(req.path) && hasOmnlOperatorAuth(req)) {
+  if (hasOmnlOperatorAuth(req)) {
     next();
     return;
   }