Separate demo provider credentials

[yoavf]

Summary

• route /translate through LLM_API_KEY and /demo through a dedicated DEMO_LLM_API_KEY
• accept DEMO_OPENROUTER_API_KEY as an alias without ever falling back to the app credential
• return a clean HTTP 503 demo message when the demo key is absent or rejected
• document independent tracking and shutdown behavior

Why

App and browser-demo traffic currently share one OpenRouter key, which makes provider-side usage attribution difficult and prevents either surface from being revoked independently.

Behavior

• /translate continues using LLM_API_KEY or OPENROUTER_API_KEY
• /demo uses only DEMO_LLM_API_KEY or DEMO_OPENROUTER_API_KEY
• if the demo credential is missing or revoked, the browser receives the browser demo is temporarily unavailable; try again later
• provider names, credential details, and upstream response bodies are not exposed

Validation

• cargo test --workspace --all-targets
• cargo clippy --workspace --all-targets -- -D warnings
• npm run test:demo — 31/31 passed
• npm run build:demo
• endpoint tests verify distinct bearer tokens plus missing and revoked demo-key behavior

Deployment

Set a separately created OpenRouter key as the Fly secret DEMO_LLM_API_KEY before merging. If it is not set, the demo is intentionally disabled while CLI translations remain available.

Greptile Summary

Separates browser-demo provider credentials from CLI translation credentials.

• Adds dedicated DEMO_LLM_API_KEY and DEMO_OPENROUTER_API_KEY configuration without fallback to application credentials.
• Returns a generic HTTP 503 response when the demo credential is absent or an upstream demo request fails.
• Documents independent credential tracking, revocation, and unauthenticated self-hosted-provider configuration.

Confidence Score: 5/5

The pull request appears safe to merge with no actionable defects identified.

The current route graph consistently selects the dedicated demo credential for /demo and the application credential for /translate, handles missing and rejected demo credentials without leaking provider details, and retains valid empty-key behavior for unauthenticated providers.

Important Files Changed

Filename	Overview
crates/server/src/main.rs	Routes demo requests through the dedicated optional credential, preserves the application credential for translations, sanitizes demo provider failures, and adds focused endpoint tests.
README.md	Documents dedicated demo credential aliases, isolation guarantees, unavailable behavior, and explicit empty-key support.
ARCHITECTURE.md	Updates the architecture and local startup example to describe independently managed CLI and demo credentials.

_{Reviews (1): Last reviewed commit: "Separate demo provider credentials" | Re-trigger Greptile}

[github-actions]

The macOS CLI preview for this PR is ready. With GitHub CLI authenticated, copy this one command to download and run it:

preview_dir="$(mktemp -d)" && gh run download 30304085021 --repo yoavf/jst --name jst-pr-preview-macos-universal --dir "$preview_dir" && chmod +x "$preview_dir/jst" && "$preview_dir/jst" --dry list files in the current directory

Replace the example arguments after jst to test another command. The artifact is retained for 7 days.

View the preview build