feat(server): FastAPI app with API-key auth and health check

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/conftest.py

@@ -0,0 +1,16 @@
+import os
+import pytest
+
+os.environ.setdefault("MUSICFETCH_API_KEY", "test-key")
+
+
+@pytest.fixture
+def client():
+    from fastapi.testclient import TestClient
+    from server.app import app
+    return TestClient(app)
+
+
+@pytest.fixture
+def auth():
+    return {"X-API-Key": "test-key"}

tests/test_auth.py

@@ -0,0 +1,16 @@
+def test_health_no_auth(client):
+    r = client.get("/health")
+    assert r.status_code == 200
+    assert r.json() == {"status": "ok"}
+
+
+def test_fetch_requires_key(client):
+    r = client.post("/fetch", params={"q": "anything"})
+    assert r.status_code == 401
+    assert "message" in r.json()
+
+
+def test_fetch_rejects_wrong_key(client):
+    r = client.post("/fetch", params={"q": "anything"},
+                    headers={"X-API-Key": "wrong"})
+    assert r.status_code == 401