remove API key requirement from POST /api/shorten

urlshort.py

@@ -6,7 +6,7 @@ Usage: python urlshort.py <config.json>
 API (all routes are prefixed with base_path, e.g. /s):
   GET  /                        Frontend (or health check if no static/)
   GET  /api/health              Health check
-  POST /api/shorten             Create a short URL  (API key required)
+  POST /api/shorten             Create a short URL  (no API key required)
   GET  /api/urls                List all short URLs  (API key required)
   GET  /api/urls/<code>         Get info for a code  (no API key required)
   GET  /api/lookup?url=<url>    Look up by original URL (no API key required)
@@ -433,10 +433,6 @@ class Handler(BaseHTTPRequestHandler):
             self._error(400, "Invalid JSON body")
             return
 
-        # Auth: check api_key from query param or body
-        if not self._check_api_key(body):
-            self._send_empty(403)
-            return
 
         # url: query param takes precedence, then body
         original_url = qs.get("url", [""])[0] or str(body.get("url", "")).strip()