Add /api/key-test diagnostic endpoint for API key verification

Provides a simple GET endpoint that validates the Authorization Bearer
token against HERMES_API_KEY and returns JSON:
  {"ok": true, "reason": "valid"} or
  {"ok": false, "reason": "key_mismatch" / "missing_bearer" / "not_configured"}

Rate limited to 4 per minute to prevent brute-force guessing.

Bump version 0.4.3 -> 0.4.4.

README.md

@@ -1,6 +1,6 @@
 # Theme Song Booth
 
-**Version:** `v0.4.3`
+**Version:** `v0.4.4`
 
 A Flask web app for a convention booth where visitors request a custom AI-generated theme song, the operator manages the queue, and the final MP3(s) are delivered by email after payment.
 

VERSION

@@ -1 +1 @@
-0.4.3
+0.4.4

app.py

@@ -516,6 +516,34 @@ def request_form():
     return render_template('request.html', form=None)
 
 
+@app.route('/api/ping', methods=['GET'])
+@app.route('/api/key-test', methods=['GET'])
+@limiter.limit('4 per minute')
+def api_key_test():
+    """
+    Diagnostic endpoint for verifying the Hermes API key configuration.
+
+    Accepts a Bearer token in the Authorization header and compares it against
+    the configured HERMES_API_KEY. Returns plain JSON so callers can distinguish
+    key mismatch from networking / signed-token issues.
+
+    Rate limited to 4 per minute to prevent brute-force guessing.
+    """
+    expected_key = get_hermes_api_key()
+    if not expected_key:
+        return jsonify({'ok': False, 'reason': 'not_configured'}), 500
+
+    auth_header = request.headers.get('Authorization', '').strip()
+    if not auth_header.startswith('Bearer '):
+        return jsonify({'ok': False, 'reason': 'missing_bearer'}), 401
+
+    provided_key = auth_header[7:].strip()
+    if not hmac.compare_digest(expected_key, provided_key):
+        return jsonify({'ok': False, 'reason': 'key_mismatch'}), 401
+
+    return jsonify({'ok': True, 'reason': 'valid'}), 200
+
+
 @app.route('/api/prompt/<int:rid>', methods=['POST'])
 def api_update_prompt(rid):
     """