fix(control-plane): pass API key to dataplane for tenant auth

[slayoffer]

Summary

• Add HINDSIGHT_CP_DATAPLANE_API_KEY env var support to control plane
• Propagate Authorization header to dataplane API in all proxy routes

Problem

Control plane proxy routes never sent an Authorization header to the dataplane API. With tenant extension active, all GUI requests failed with "Invalid API key".

Solution

1. Add getDataplaneHeaders() helper in hindsight-client.ts:

export function getDataplaneHeaders(additional?: Record<string, string>) {
  const headers: Record<string, string> = { ...additional };
  if (process.env.HINDSIGHT_CP_DATAPLANE_API_KEY) {
    headers["Authorization"] = \`Bearer \${process.env.HINDSIGHT_CP_DATAPLANE_API_KEY}\`;
  }
  return headers;
}

2. Update all API route handlers to use getDataplaneHeaders():

// Before
fetch(url, { method: "GET" })

// After  
fetch(url, { method: "GET", headers: getDataplaneHeaders() })

Configuration

# In control plane .env
HINDSIGHT_CP_DATAPLANE_API_KEY=your-dataplane-api-key

Files modified

• src/lib/hindsight-client.ts - Add helper function
• src/app/api/**/*.ts - Update all route handlers

Test plan

• Control plane works without env var (backwards compatible)
• Control plane works with tenant extension when env var is set
• All proxy routes pass auth header correctly

🤖 Generated with Claude Code

[nicoloboschi]

LGTM