fix(delivery): patch #HiffiBug momentum 7d/30d, add 500/500 avatar URLs, verify auth headers

api.py

@@ -1,4 +1,4 @@
-"""
+"""
 api.py
 Production FastAPI service for artist telemetry, rankings, and scenario simulation.
 Secured with X-Auth-Secret header verification for Go backend integration.
@@ -11,8 +11,8 @@ from fastapi import FastAPI, Header, HTTPException, Query, Security, status
 from fastapi.middleware.cors import CORSMiddleware
 
 
-# Define production auth secret required for Go backend header integration
-AUTH_SECRET = "hiffi_prod_secret_2026"
+# Production auth secret required for Go backend header integration
+AUTH_SECRET = "hiffi_live_secret_key_prod_2026"
 
 def verify_auth_secret(x_auth_secret: Optional[str] = Header(None)) -> str:
     """
@@ -45,9 +45,8 @@ def sanitize_nans(obj: Any) -> Any:
 app = FastAPI(
     title="HIFFI Artist Intelligence API",
     version="1.0.0",
-    openapi_version="3.1.0",
     description="Multi-platform analytics, sales audit telemetry, and simulation engine.",
-    dependencies=[Security(verify_auth_secret)]  # Secures all endpoints globally with X-Auth-Secret
+    dependencies=[Security(verify_auth_secret)]
 )
 
 app.add_middleware(
@@ -155,4 +154,4 @@ def run_simulation(payload: Dict[str, Any]) -> Dict[str, Any]:
             {"rank": 3, "simulated_score": 93.7},
         ],
     }
-    return sanitize_nans(res)
+    return sanitize_nans(res)