fix(security): redact LEMMA_API_KEY from committed wrangler.toml

[yumemayu]

Summary

Per the 4/18 assessment Phase 1-A (security hard blocker): packages/worker/wrangler.toml had LEMMA_API_KEY committed as a literal string under [vars]. This PR removes the literal from HEAD and aligns the codebase with Cloudflare Workers' standard secret pattern.

Files touched

File	Change
packages/worker/wrangler.toml	Drop the literal LEMMA_API_KEY = "…" line from [vars]. Add a comment pointing to wrangler secret put LEMMA_API_KEY --cwd packages/worker (for deploys) and packages/worker/.dev.vars (gitignored, for local dev).
.env.example	Rewrite the LEMMA_API_KEY block with the same guidance.
README.md	Extend the Configure step so contributors put LEMMA_API_KEY into .dev.vars alongside the CDP keys; replace the old "the worker ships with a demo LEMMA_API_KEY" note with the new secret-based flow.
packages/worker/src/index.test.ts	Add a regression test that reads wrangler.toml and asserts no literal LEMMA_API_KEY = … assignment under [vars]. Fails loudly if anyone re-introduces a committed value.

Worker code (unchanged)

The worker already reads LEMMA_API_KEY exclusively from c.env (typed in Env, used by lemmaHeaders()). Only the source of the value changes.

Out of scope (per the brief)

• Phase 1-B (TypeError) and Phase 1-C (API path): not actioned. The 4/18 assessment doc isn't present in the repo, no matching TypeError reproduces in the current test suite, and Phase 1-C paths already match @lemmaoracle/spec@0.0.21 (/v1/verified-attributes/query). PR fix: remove DEMO_MODE, add minimal Vitest tests #6 already added path-consistency tests for the agent / worker endpoints.
• Phase 2 (DEMO_MODE default change): already completed in PR fix: remove DEMO_MODE, add minimal Vitest tests #6 (DEMO_MODE fully removed; real on-chain requests always).
• Phase 3 docs: only the LEMMA_API_KEY-related lines are touched here; the rest of the docs are coherent with the current state.
• Bedrock AgentCore integration, KYC attribute-proof demo, x402 Bazaar metadata: out of scope per the brief.

Operational follow-up (not in this PR)

Rotate the LEMMA_API_KEY on the Lemma side and store the new value via wrangler secret put. The previously committed value remains visible in git history — removing it from HEAD does not erase it from prior commits.

Test plan

• pnpm test — 7 worker tests pass (was 6; +1 regression test), 5 agent tests pass.
• pnpm --filter @example-x402/worker run type-check — 0 errors.
• After merge: run npx wrangler secret put LEMMA_API_KEY --cwd packages/worker (with a fresh, rotated key) on each deployed Worker environment.
• Confirm the new key works against https://workers.lemma.workers.dev/v1/verified-attributes/query via a manual pnpm dev:worker + pnpm agent round-trip.

🤖 Generated with Claude Code

[aggre]

LGTM — demo key rotation is unnecessary given the context (example repo, no self-service key issuance, demo-scoped key). The structural fix (removing literal from vars, pointing to secret pattern) is the right change.

[aggre]

Hold decision (CTO)

This PR is on hold until a self-service API Key issuance dashboard is implemented (#10).

Rationale: The current demo key is intentionally exposed as an accepted risk. Redacting it from config without providing users a way to issue their own keys would break the demo experience. Once the dashboard is ready, this PR can be merged + the key rotated.

Do NOT merge until #10 is resolved.

[aggre]

Closing per discussion (2026-05-14): the API key in wrangler.toml is intentionally committed — it's a demo-only, read-only key scoped to demo data. The Lemma API has no delete/put endpoints, so there is no real leak risk. No rotation needed at this time. Will revisit when write endpoints are added.