fix(router): validate LiteLLM master key and enforce client auth in responses_api (PR #384 follow-up)

[sheepdestroyer]

Summary

During the GitHub operations audit of PR #384 (fix(router): use LiteLLM master key in responses_api and default backend_conf in execute_proxy), security and stability improvements were identified based on CodeRabbit review feedback and system verification:

Identified Issues & Required Improvements

1. LiteLLM Master Key Fail-Fast Validation (router/main.py):

   • os.getenv("LITELLM_MASTER_KEY") can resolve to None or placeholder strings (e.g., producing Bearer None), causing opaque upstream authorization failures.
   • Action: Validate LITELLM_MASTER_KEY before constructing Authorization headers in responses_api and execute_proxy pathways.

2. Enforce Caller Authentication on Responses Endpoints:

   • Routes /v1/responses and /responses proxy upstream using the server's master key without authenticating incoming client requests first.
   • Action: Add client authentication dependency checks before upstream forwarding.

3. Dynamic OpenRouter Model Sync & Purge:

   • Ensure OpenRouter models loaded from LiteLLM config are dynamically registered into LiteLLM DB on lifespan startup while purging stale database entries.

Related Pull Request

• Follow-up for PR fix(router): use LiteLLM master key in responses_api and default backend_conf in execute_proxy #384 (fix(router): use LiteLLM master key in responses_api and default backend_conf in execute_proxy #384)

Component Scope

• router/main.py
• scripts/verification/verify_canonical_endpoints.py