Add request authentication header injection

[codebestia]

Description

Every outgoing request must carry an Authorization: Bearer <secret_key> header derived from the active config. This logic must live in the HTTP client, not scattered across resource methods, so it is impossible to accidentally omit it.

Proposed Steps

• In _SyncHTTPClient and _AsyncHTTPClient, accept api_key in the constructor.
• Merge {"Authorization": f"Bearer {api_key}"} into the default headers on every request.
• Never log or include the full key in debug output — mask to sk_live_****xxxx.
• Ensure public key (pk_) cannot be used for mutating requests (POST/PATCH/DELETE) — raise AuthenticationError.

Acceptance Criteria

• Every request carries an Authorization header with the correct bearer token.
• Debug logs show a masked key, never the full secret.
• Using a public key for a write request raises AuthenticationError before the network call.
• Changing api_key on the client causes subsequent requests to use the new key.

[Awointa]

Hi, I’m interested in this issue. I have experience building SDKs and API clients with secure authentication and request middleware design.

I can implement centralized bearer token handling in both sync and async HTTP clients, enforce automatic Authorization headers on every request, mask secret keys in logs, block public keys from mutating requests, and add tests to verify secure key handling and request behavior.