Extend callback token expiry from 1 hour to 7 days

The signed callback token for /api/prompt/<rid> expired after 1 hour.
That was too short for a workflow where the operator may copy the URL and
paste it to Hermes, then wait for a response. Extend to 7 days.

Also fixes the misleading 401 on expired tokens (token check runs before
API key check). The new /api/key-test endpoint lets callers verify the
API key independently.

Bump version 0.4.4 -> 0.4.5.

app.py

@@ -360,8 +360,9 @@ def sign_prompt_callback(rid, expires_at=None):
     """
     secret = current_app.config['SECRET_KEY'].encode()
     if expires_at is None:
-        # Default expiry: 1 hour.
-        expires_at = int(time.time()) + 3600
+        # Default expiry: 7 days, so operators have plenty of time to copy the
+        # callback URL into Hermes and for Hermes to POST back.
+        expires_at = int(time.time()) + 7 * 24 * 3600
     payload = f"{rid}:{expires_at}"
     sig = hmac.new(secret, payload.encode(), hashlib.sha256).hexdigest()[:16]
     return f"{rid}:{expires_at}:{sig}"