All API requests (except /health) require the X-API-Key header:
Requests without a valid API key receive 401 Unauthorized.