Enforce canonical key format in validate_key_format (both copies)

[simpleqt]

Fixes #2427

Summary

validate_key_format exists in two copies — src/memos/api/utils/api_keys.py and src/memos/api/middleware/auth.py (the one gating every authenticated request) — and both validate the hex part with int(hex_part, 16), which accepts forms a generated key can never have:

>>> validate_key_format("krlk_" + "+" + "a"*63)          # leading sign
True
>>> validate_key_format("krlk_" + "0x" + "a"*62)          # 0x prefix
True
>>> validate_key_format("krlk_" + "a"*30 + "_" + "b"*33)  # underscores
True

So the documented krlk_<64-hex-chars> format is not actually enforced.

Fix

Enforce the exact form generate_api_key() produces with a fullmatch against [0-9a-f]{64} in both copies. Every currently-issued key still passes; only the non-canonical spellings stop doing so.

Regression test

Added tests/api/test_api_key_format.py (following the package-stub pattern used by tests/api/test_client.py):

• red/green verified: the non-canonical cases fail against the old implementation and pass with the fix
• pins that a freshly generate_api_key()-produced key still validates
• covers both copies of the validator (api utils + auth middleware)

ruff check (repo-pinned 0.11.8) passes on all touched files.

AI Disclosure

• Tool(s): Claude (ZCode CLI)
• Used for: debugging assistance, code suggestions, and drafting this PR description. All changes human-reviewed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Memtensor-AI]

🤖 Open Code Review

Target: PR #2429
Task: 8d72db9ac3fbf0de
Base: main
Head: sq/api-key-format

🔍 OpenCodeReview found 1 issue(s) in this PR.

---

1. tests/api/test_api_key_format.py (L76-L78)

The two length boundary checks are split across modules: api_keys_module is only tested with a 63-char hex part and auth_module only with a 65-char hex part. Both modules implement the same validate_key_format logic, so each should be checked for both off-by-one boundaries (63 and 65). A regression in either module could slip through undetected.

💡 Suggested Change

Before:

def test_wrong_length_is_rejected(api_keys_module, auth_module):
    assert not api_keys_module.validate_key_format("krlk_" + "a" * 63)
    assert not auth_module.validate_key_format("krlk_" + "a" * 65)

After:

def test_wrong_length_is_rejected(api_keys_module, auth_module):
    for mod in (api_keys_module, auth_module):
        assert not mod.validate_key_format("krlk_" + "a" * 63)
        assert not mod.validate_key_format("krlk_" + "a" * 65)

Generated by cloud-assistant via Open Code Review.

[Memtensor-AI]

✅ Automated Test Results: PASSED

All tests passed (9/9 executed). memos_python_core/changed-repo-python: 9/9. Duration: 1s [advisory, non-gating] AI-generated tests on branch test/auto-gen-8d72db9ac3fbf0de-20260929004558: 50/50 passed — these do NOT affect the PR verdict; review the branch manually.

Branch: sq/api-key-format