feat(security): implement dynamic tactical license gate, instant key revocation, and clean hardcoded credentials

apps/api/scripts/evaluate_geocoding.ts

@@ -4,7 +4,7 @@ import axios from 'axios';
 
 // Constants
 const API_URL = process.env.TEST_API_URL || 'https://map-saas.intaleqapp.com/api/geocoding/search';
-const API_KEY = process.env.TEST_API_KEY || 'zP9vL5mK2nQ8xR7jT4wS1yB6hG3fV0cX';
+const API_KEY = process.env.TEST_API_KEY || process.env.MAP_API_KEY || '';
 let DATA_FILE = path.join(__dirname, '../../../data/golden_tests/queries_syria.json');
 if (!fs.existsSync(DATA_FILE) && fs.existsSync('/data/data/golden_tests/queries_syria.json')) {
   DATA_FILE = '/data/data/golden_tests/queries_syria.json'; // Docker environment fallback

apps/api/scripts/load_test_geocoding.ts

@@ -1,7 +1,7 @@
 import axios from 'axios';
 
 const API_URL = process.env.TEST_API_URL || 'http://localhost:3200/api/geocoding/search';
-const API_KEY = process.env.TEST_API_KEY || 'zP9vL5mK2nQ8xR7jT4wS1yB6hG3fV0cX';
+const API_KEY = process.env.TEST_API_KEY || process.env.MAP_API_KEY || '';
 const TOTAL_REQUESTS = 5000;
 const CONCURRENCY = 50; // Number of parallel requests
 

apps/api/scripts/test_autocomplete.ts

@@ -1,7 +1,7 @@
 import axios from 'axios';
 
 const API_URL = process.env.TEST_API_URL || 'http://localhost:3200/api/geocoding/autocomplete';
-const API_KEY = process.env.TEST_API_KEY || 'zP9vL5mK2nQ8xR7jT4wS1yB6hG3fV0cX';
+const API_KEY = process.env.TEST_API_KEY || process.env.MAP_API_KEY || '';
 
 const testQueries = [
   "مستش",

apps/api/scripts/test_did_you_mean.ts

@@ -1,7 +1,7 @@
 import axios from 'axios';
 
 const API_URL = process.env.TEST_API_URL || 'http://localhost:3200/api/geocoding/search';
-const API_KEY = process.env.TEST_API_KEY || 'zP9vL5mK2nQ8xR7jT4wS1yB6hG3fV0cX';
+const API_KEY = process.env.TEST_API_KEY || process.env.MAP_API_KEY || '';
 
 const testQueries = [
   "السمساني",      // Should suggest "الشميساني"

apps/api/scripts/test_failed_searches.ts

@@ -2,7 +2,7 @@ import axios from 'axios';
 import { Client } from 'pg';
 
 const API_URL = process.env.TEST_API_URL || 'http://localhost:3200/api/geocoding/search';
-const API_KEY = process.env.TEST_API_KEY || 'zP9vL5mK2nQ8xR7jT4wS1yB6hG3fV0cX';
+const API_KEY = process.env.TEST_API_KEY || process.env.MAP_API_KEY || '';
 const DB_URL = process.env.DATABASE_URL || 'postgresql://mapuser:TestMapPass123!@localhost:5432/mapdb';
 
 async function testFailedLogging() {

apps/api/scripts/test_poi_gates.ts

@@ -1,7 +1,7 @@
 import axios from 'axios';
 
 const API_URL = process.env.TEST_API_URL || 'http://localhost:3200/api/geocoding/search';
-const API_KEY = process.env.TEST_API_KEY || 'zP9vL5mK2nQ8xR7jT4wS1yB6hG3fV0cX';
+const API_KEY = process.env.TEST_API_KEY || process.env.MAP_API_KEY || '';
 
 const testQueries = [
   "سيتي مول",

apps/api/scripts/test_relative_queries.ts

@@ -2,7 +2,7 @@ import axios from 'axios';
 
 const API_URL = process.env.TEST_API_URL || 'http://localhost:3200/api/geocoding/search';
 const AUTO_URL = process.env.TEST_AUTO_URL || 'http://localhost:3200/api/geocoding/autocomplete';
-const API_KEY = process.env.TEST_API_KEY || 'zP9vL5mK2nQ8xR7jT4wS1yB6hG3fV0cX';
+const API_KEY = process.env.TEST_API_KEY || process.env.MAP_API_KEY || '';
 
 const testQueries = [
   "قرب مستشفى",