Remove API key requirement

.gitea/workflows/build.yml

@@ -4,7 +4,6 @@ on:
   # Manual only for now. Select the branch to build when dispatching:
   #   main -> APP_VERSION is the current git tag
   #   dev  -> APP_VERSION is the current commit hash
-  # Both branches bake the portal API key from secrets.
   workflow_dispatch:
 
 jobs:
@@ -44,28 +43,18 @@ jobs:
           else
             APP_VERSION="$(git rev-parse --short HEAD)"
           fi
-          echo "APP_VERSION=$APP_VERSION" >> "$GITHUB_ENV"
           echo "Branch: ${{ gitea.ref_name }} -> APP_VERSION=$APP_VERSION"
-          if [ -n "${{ secrets.RWT_API_KEY }}" ]; then
-            echo "API key: provided via secret RWT_API_KEY"
-          else
-            echo "API key: NOT set (build proceeds without an Authorization header)"
-          fi
 
       # checks is keyed per-system (checks.<system>.default); nix build's
       # #attr shorthand can't resolve it, so resolve the current system inline.
-      # --impure lets the flake read APP_VERSION/API_KEY via builtins.getEnv
+      # --impure lets the flake read APP_VERSION via builtins.getEnv
       # (pure evals always get the package defaults). The offline test suite
       # runs in the package's checkPhase.
       - name: Build + offline test suite
-        env:
-          API_KEY: ${{ secrets.RWT_API_KEY }}
         run: nix build -L ".#checks.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" --impure
 
       - name: Live portal tests
-        if: ${{ secrets.RWT_LIVE_API_KEY != '' }}
         env:
-          RWT_LIVE_API_KEY: ${{ secrets.RWT_LIVE_API_KEY }}
           RWT_LIVE_ACCOUNT_EMAIL: ${{ secrets.RWT_LIVE_ACCOUNT_EMAIL }}
           RWT_LIVE_LICENSE_EMAIL: ${{ secrets.RWT_LIVE_LICENSE_EMAIL }}
           RWT_LIVE_LICENSE_KEY: ${{ secrets.RWT_LIVE_LICENSE_KEY }}