fix: 所有写操作 API 鉴权 + .env 变量名修复

api/server.py

@@ -446,7 +446,7 @@ def translate_status(arxiv_id: str):
 
 # ─── Routes: PDF download on-demand ────────────────────
 @app.post("/api/download/{arxiv_id}")
-def download_single_pdf(arxiv_id: str):
+def download_single_pdf(arxiv_id: str, _=Depends(verify_api_key)):
     """按需下载单篇 arXiv PDF"""
     import subprocess, sys
     pdf_path = PAPERS_DIR / "arxiv" / f"{arxiv_id}.pdf"
@@ -494,7 +494,7 @@ def translation_status():
     return {"translating": list(_translating)}
 
 @app.post("/api/translate/{paper_id}")
-async def trigger_translation(paper_id: str):
+async def trigger_translation(paper_id: str, _=Depends(verify_api_key)):
     """Trigger pdf2zh translation for a paper (DeepSeek V4 Flash).
     paper_id can be arxiv ID (e.g. 1706.03762) or a HF filename."""
     # Find the PDF