[overcuriousity]

Consolidates every open Dependabot PR into one change, and adds tests proving the REST API works without an API key.

Dependency bumps (all 22 open Dependabot PRs, none skipped)

PR	Bump
#89	lazy_static 1.5.0 → 1.5.1
#88	qrcode-generator 5.0.0 → 6.1.2 (major, code migrated)
#87	rust-embed 8.12.0 → 8.13.0
#86	actix-multipart 0.8.0 → 0.8.5
#85	actix-web-httpauth 0.8.2 → 0.8.3
#84	rand 0.10.2 → 0.10.3
#81	clap 4.6.2 → 4.6.7
#80	askama 0.16.0 → 0.16.1
#79	log 0.4.33 → 0.4.34
#78	actix-files 0.6.10 → 0.7.0 (major, no code changes needed)
#77	actix-web 4.14.0 → 4.15.0
#74	rusqlite 0.40.1 → 0.40.2
#73	futures 0.3.32 → 0.3.34
#70	html-escape 0.2.14 → 0.2.15
#69	bytesize 2.4.2 → 2.7.0
#68	serde 1.0.228 → 1.0.229
#65	serde_json 1.0.150 → 1.0.151 (lock resolved to 1.0.152)
#63	docker/login-action v3 → v4
#62	docker/build-push-action v6 → v7
#61	docker/setup-qemu-action v3 → v4
#60	docker/setup-buildx-action v3 → v4
#59	docker/metadata-action v5 → v6

cargo update -p also brought in transitive updates (e.g. actix-http 3.18.12, actix-server 2.9.4); the lockfile diff has the full list.

Supersedes #59 #60 #61 #62 #63 #65 #68 #69 #70 #73 #74 #77 #78 #79 #80 #81 #84 #85 #86 #87 #88 #89. Close them once this PR is merged.

Code changes

• qrcode-generator 6: to_svg_to_string is gone; string_to_qr_svg now uses qr::Encoder + Renderer::to_svg_string (same error-correction level and size, src/util/misc.rs). Default features are off (features = ["qr"]) so the new image/png deps aren't pulled in.
• actix-web 4.15: HttpResponse is now big enough to trip clippy's result_large_err on require_api_key, so the error is boxed (src/endpoints/api.rs).

Keyless API access

• require_api_key now delegates to check_api_key(configured, req) so a key can be injected in tests.
• api_works_without_api_key_or_basic_auth: actix test::init_service integration test. With no key and no Basic Auth it runs POST /api/v1/paste, GET /api/v1/paste/{id}, GET /api/v1/pastes, PATCH and DELETE with no Authorization header, and all of them succeed.
• configured_api_key_is_enforced: with a key configured, a request with no header gets 401 API_KEY_REQUIRED, a wrong bearer token is rejected, and the right one is accepted.
• Under cfg(test), ARGS is parsed from a fixed argv (--editable, temp --data-dir) instead of the test harness's own CLI flags.
• README: the API section now opens with an unauthenticated curl example and says the key is optional.

Verification (local, rustc 1.99)

• cargo fmt --check, cargo clippy -- -D warnings (also --all-targets), cargo test: 5 passed
• cargo build --release: OK
• Smoke test: release binary on 127.0.0.1 with no BITVAULT_API_KEY, curl -X POST /api/v1/paste with no auth header → HTTP/1.1 201 Created

Known issue (not fixed here, out of scope)

If both Basic Auth and BITVAULT_API_KEY are configured, the API can't be used. Both read the single Authorization header (Basic vs Bearer), so no request can satisfy both. The README line saying clients should "send Basic Auth credentials alongside the Bearer token" describes something that can't be done.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[overcuriousity]

CTO review (MIK-85/MIK-86): LGTM. CI green (Check & Test, CodeQL). Reviewed the non-lockfile diff; keyless + key-enforced tests cover the API change. Extra check: release build on loopback with --qr, GET /qr/{id} → 200 with a 256x256 SVG, so the qrcode-generator 6.x migration renders. Known pre-existing issue (Basic Auth + API key both on the Authorization header) tracked separately.