feat: finalize root api.py with X-Auth-Secret auth security and clean pure sales cohort

api.py

@@ -1,15 +1,31 @@
 """
-HIFFI Artist Intelligence API
+api.py
 Production FastAPI service for artist telemetry, rankings, and scenario simulation.
+Secured with X-Auth-Secret header verification for Go backend integration.
 """
 
 import math
 from typing import Any, Dict, List, Optional
 import pandas as pd
-from fastapi import FastAPI, HTTPException, Query
+from fastapi import FastAPI, Header, HTTPException, Query, Security, status
 from fastapi.middleware.cors import CORSMiddleware
 
 
+# Define production auth secret required for Go backend header integration
+AUTH_SECRET = "hiffi_prod_secret_2026"
+
+def verify_auth_secret(x_auth_secret: Optional[str] = Header(None)) -> str:
+    """
+    Validates the incoming X-Auth-Secret header for backend-to-backend communication.
+    """
+    if x_auth_secret != AUTH_SECRET:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or missing X-Auth-Secret header"
+        )
+    return x_auth_secret
+
+
 def sanitize_nans(obj: Any) -> Any:
     """
     Recursively converts float NaN and Infinity to None
@@ -31,6 +47,7 @@ app = FastAPI(
     version="1.0.0",
     openapi_version="3.1.0",
     description="Multi-platform analytics, sales audit telemetry, and simulation engine.",
+    dependencies=[Security(verify_auth_secret)]  # Secures all endpoints globally with X-Auth-Secret
 )
 
 app.add_middleware(
@@ -45,6 +62,7 @@ app.add_middleware(
 def load_dataset() -> pd.DataFrame:
     """Loads artist dataset with fallback paths."""
     candidate_paths = [
+        "data/hiffi_multiplatform_500.csv",
         "data/final_artists.csv",
         "data/artists.csv",
         "final_artists.csv",
@@ -110,7 +128,6 @@ def list_artists(
     if df.empty:
         return []
 
-    # Clean missing values at dataframe level
     df = df.where(pd.notnull(df), None)
 
     if scope == "verified" and "verified" in df.columns: