fix: include API key in CORS proxy requests for MCP connections

[satishkc7]

Problem

When llama-server is started with both --api-key-file and --webui-mcp-proxy, the /cors-proxy endpoint is subject to the global API key validation middleware. MCP connections configured with "Use Proxy" fail with a 401 because the WebUI does not include the Authorization header in its requests to /cors-proxy.

Fixes #21167

Root Cause

In MCPService.createTransport(), requestInit.headers was only populated with buildProxiedHeaders(config.headers) — which wraps the target MCP server's headers using the X-Proxy-Header-* convention. The Authorization: Bearer <api-key> header needed to authenticate the request against llama-server itself was never included.

Fix

Import the existing getAuthHeaders() utility and spread it into requestInit.headers when useProxy is true:

if (useProxy) {
    requestInit.headers = {
        ...getAuthHeaders(),
        ...(requestInit.headers as Record<string, string>)
    };
}

getAuthHeaders() returns { Authorization: 'Bearer <key>' } when an API key is configured, or an empty object otherwise — so there is no regression when no API key is set.

Testing

1. Start llama-server with --api-key-file <file> --webui-mcp-proxy
2. Authenticate with the WebUI using the API key
3. Add an MCP server with "Use Proxy" enabled
4. Connection succeeds (previously failed with 401)

[satishkc7]

Thanks for the note. The fix was written by me - I traced the issue through createTransport() in mcp.service.ts, identified that requestInit.headers was never populated with the auth header for the proxy request itself, and wrote the change. Happy to discuss the implementation directly with reviewers.

[satishkc7]

Good catch, that's cleaner. I'll update the PR with your suggestion.

[allozaur]

I will merge this and push static build in another PR that im about to merge