Tablet 45: the courtyard gate checks the key, not the shape of the header

/courtyard/* and /chatzer/* admitted any `Authorization: Bearer <x>`.
Every test sent `Bearer test-token`; none sent a wrong one. Every
admitted request spends the day's manna.

VavPipeline.BigdeiKodesh.Gate: keys are a file (Construction §4.6 —
never env, never config, never git), one `tier key` per line, tiers
courtyard < chatzer (the inner ring opens the outer). Constant-time
compare against every line; no file / empty / unreadable → nobody
passes, GATE_NO_KEYS in the log, the caller told only "missing or
invalid". 403 FORBIDDEN for an outer key at an inner gate. Read on
every request so a rotated key is live in ~1 min without a rollout.

Deploy: Secret shorashim-api-keys projected at
/etc/shorashim/secrets/api_keys (vav-pipeline only, 0440),
API_KEYS_FILE in the configmap, template + issue/rotate recipe in
secrets.yaml and KOHEN.md "Issuing a key". Spec: tamid §1.1 (gate,
403), vayakhel §4.6. Doorpost 91d09d8d… → 42b38626….
Tests: tablet45_gate_test (parse, tiers, wrong/near/empty/no key, no
file) — Elixir 527/0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

specs/shorashim_tamid.md

@@ -53,6 +53,15 @@ Rate limit: 10 requests per minute per IP
 
 #### Machaneh Leviyah — Authenticated Endpoint
 
+**The gate.** A key is a line in the keys file
+(`/etc/shorashim/secrets/api_keys`, Construction §4.6 — a file, never an
+environment variable), `tier key`, tier `courtyard` or `chatzer`. The
+key is compared in constant time against every line; a `chatzer` key
+opens the courtyard too, a `courtyard` key at the chatzer is 403. No
+file or no keys: nobody passes, and the log says `GATE_NO_KEYS`. The
+caller is never told why beyond "missing or invalid API key". Issued by
+the kohen (KOHEN.md "Issuing a key"); the key never appears in a log.
+
 ```
 Endpoint: POST /courtyard/offering
 
@@ -94,6 +103,7 @@ Response:
 
 Errors:
   401 — Invalid or missing API key
+  403 — A key for an outer ring at an inner gate
   422 — Input failed kiyor (validation). Body includes purification guidance.
   429 — Rate limit exceeded. Body includes manna explanation.
   503 — System in Shabbat/festival mode. Body includes resumption time.
@@ -162,6 +172,7 @@ Response (200):
 
 Errors:
   401 — Invalid or missing API key
+  403 — A key for an outer ring at an inner gate
   422 — Missing or empty output, output over 65,536 bytes, unknown model
   503 — MANNA_DEPLETED (provision exhausted), KORBAN_UNAVAILABLE,
         TALMUDIC_UNAVAILABLE. Body says which; resubmit: true.