feat: allow Sanctum-authenticated sessions through VerifyApiKey middleware

Enables stateful API via Sanctum so the Vue SPA can call /api/* routes
using cookie auth, without requiring an X-Api-Key header.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/Http/Middleware/VerifyApiKey.php

@@ -4,9 +4,10 @@ namespace App\Http\Middleware;
 
 use Closure;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
 use Symfony\Component\HttpFoundation\Response;
 
-class VerifyApiKey
+final class VerifyApiKey
 {
     /**
      * Handle an incoming request.
@@ -15,6 +16,10 @@ class VerifyApiKey
      */
     public function handle(Request $request, Closure $next): Response
     {
+        if (Auth::guard('sanctum')->check()) {
+            return $next($request);
+        }
+
         if ($request->header('X-Api-Key') !== config('app.api_secret_key')) {
             abort(403);
         }