fix(bridge): remove hardcoded API_KEY fallback, fail closed if env var missing

The previous code had `const API_KEY = process.env.API_KEY || "myristica-evo-2026"`
which silently fell back to a hardcoded secret if the env var was unset.

This meant the bridge would accept auth requests with a key that is
publicly visible in git history if /etc/systemd/system/wa-bridge.service
was ever misconfigured. Replaced with explicit fail-closed check.