debug: add auth mismatch logging

Logs the first 8 chars of expected vs provided API key on 401
to diagnose auth issues from EspoCRM.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

api/routes/smart_assistant.py

@@ -27,6 +27,11 @@ def _verify_auth(request: Request):
         return  # No auth configured
     provided = request.headers.get("X-Api-Key", "")
     if provided != expected:
+        logger.warning(
+            "[auth] Key mismatch — expected=%s... provided=%s...",
+            expected[:8] if expected else "NONE",
+            provided[:8] if provided else "NONE",
+        )
         raise HTTPException(status_code=401, detail="Unauthorized")