Adds `VerifyApiKey` middleware to validate `X-Api-Key` header against `app.api_secret_key` config. Returns 403 if key is missing or invalid.