Tablet 45: the courtyard gate checks the key, not the shape of the header

/courtyard/* and /chatzer/* admitted any `Authorization: Bearer <x>`.
Every test sent `Bearer test-token`; none sent a wrong one. Every
admitted request spends the day's manna.

VavPipeline.BigdeiKodesh.Gate: keys are a file (Construction §4.6 —
never env, never config, never git), one `tier key` per line, tiers
courtyard < chatzer (the inner ring opens the outer). Constant-time
compare against every line; no file / empty / unreadable → nobody
passes, GATE_NO_KEYS in the log, the caller told only "missing or
invalid". 403 FORBIDDEN for an outer key at an inner gate. Read on
every request so a rotated key is live in ~1 min without a rollout.

Deploy: Secret shorashim-api-keys projected at
/etc/shorashim/secrets/api_keys (vav-pipeline only, 0440),
API_KEYS_FILE in the configmap, template + issue/rotate recipe in
secrets.yaml and KOHEN.md "Issuing a key". Spec: tamid §1.1 (gate,
403), vayakhel §4.6. Doorpost 91d09d8d… → 42b38626….
Tests: tablet45_gate_test (parse, tiers, wrong/near/empty/no key, no
file) — Elixir 527/0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

KOHEN.md

@@ -488,6 +488,29 @@ curl https://shorashim.ch/kodesh/status | jq .halt_status
 curl https://shorashim.ch/kodesh/status | jq '.refuge_components'
 ```
 
+### Issuing a key — *Mishmeret HaSha'ar*
+
+The courtyard and the chatzer open only to a key you issued. Keys live
+in the `shorashim-api-keys` Secret, mounted as a file; the gate reads
+the file on every request, so a change takes effect within about a
+minute, without a rollout. One line per key: `courtyard <key>` (offerings,
+bedikot) or `chatzer <key>` (also the Sanhedrin; opens the courtyard too).
+
+```bash
+umask 077; TMP=$(mktemp)
+kubectl get secret shorashim-api-keys -n shorashim -o jsonpath='{.data.api_keys}' \
+  | base64 -d > "$TMP" 2>/dev/null || true          # existing keys, if any
+printf 'courtyard %s\n' "$(openssl rand -hex 32)" >> "$TMP"
+kubectl create secret generic shorashim-api-keys -n shorashim \
+  --from-file=api_keys="$TMP" --dry-run=client -o yaml | kubectl apply -f -
+tail -1 "$TMP"      # hand this line's key to its bearer, then
+rm -f "$TMP"
+```
+
+To revoke: remove the line the same way. Without the Secret the pod
+does not start; with an empty file nobody passes (`GATE_NO_KEYS` in the
+vav-pipeline log).
+
 ### Checking a model's output — *Bedikah*
 
 The external check (Tamid §1.1, *lo taaseh lekha* §9.1). Hand it any