feat(apicore-sync): authenticate with an ApiCore API key

APICORE_API_KEY replaces the service-account login: the key is sent as
the bearer token directly, needs no password and no MFA exemption, may
only read the shop feed and can be revoked in ApiCore at any time. A
malformed key is rejected with a clear message before any request.
Email/password stays as fallback for ApiCore versions without keys.

The system status treats the key or the legacy login as configured.
README, .env.example and the k8s secret template describe the key.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

src/lib/apicore-client.ts

@@ -77,20 +77,47 @@ export interface ApiCoreSession {
   readonly token: string;
 }
 
-function getConfig(): { baseUrl: string; email: string; password: string } {
-  const baseUrl = process.env.APICORE_API_URL;
+type ApiCoreCredentials =
+  | { baseUrl: string; apiKey: string }
+  | { baseUrl: string; email: string; password: string };
+
+// ack_<8 Zeichen>_<43 Zeichen> — Format der ApiCore-API-Schluessel.
+const API_KEY_PATTERN = /^ack_[a-z0-9]{8}_[A-Za-z0-9_-]{43}$/;
+
+/**
+ * Bevorzugt einen ApiCore-API-Schluessel (APICORE_API_KEY): kein Passwort,
+ * keine MFA-Frage, nur die Berechtigung "shop-sync:read", in ApiCore
+ * jederzeit widerrufbar. E-Mail/Passwort eines Service-Kontos bleibt als
+ * Rueckfall fuer aeltere ApiCore-Staende ohne API-Schluessel.
+ */
+function getConfig(): ApiCoreCredentials {
+  const baseUrl = process.env.APICORE_API_URL?.trim().replace(/\/$/, "");
+  const apiKey = process.env.APICORE_API_KEY?.trim();
   const email = process.env.APICORE_SYNC_EMAIL;
   const password = process.env.APICORE_SYNC_PASSWORD;
-  if (!baseUrl || !email || !password) {
-    throw new ApiCoreConfigError(
-      "ApiCore-Synchronisierung ist nicht konfiguriert. Bitte APICORE_API_URL, APICORE_SYNC_EMAIL und APICORE_SYNC_PASSWORD setzen (siehe .env.example)."
-    );
+  if (baseUrl && apiKey) {
+    if (!API_KEY_PATTERN.test(apiKey)) {
+      throw new ApiCoreConfigError(
+        "APICORE_API_KEY hat nicht das Format eines ApiCore-API-Schlüssels (ack_…). Bitte den Schlüssel vollständig aus ApiCore → Verwaltung → Automatisierung → API-Schlüssel übernehmen."
+      );
+    }
+    return { baseUrl, apiKey };
   }
-  return { baseUrl: baseUrl.replace(/\/$/, ""), email, password };
+  if (baseUrl && email && password) {
+    return { baseUrl, email, password };
+  }
+  throw new ApiCoreConfigError(
+    "ApiCore-Synchronisierung ist nicht konfiguriert. Bitte APICORE_API_URL und APICORE_API_KEY setzen (siehe .env.example)."
+  );
 }
 
 export async function openApiCoreSession(): Promise<ApiCoreSession> {
-  const { baseUrl, email, password } = getConfig();
+  const config = getConfig();
+  // Ein API-Schluessel wird direkt als Bearer-Token gesendet — kein Login.
+  if ("apiKey" in config) {
+    return { baseUrl: config.baseUrl, token: config.apiKey };
+  }
+  const { baseUrl, email, password } = config;
 
   let res: Response;
   try {