fix(swap-service): pass the BOB Gateway API key through to the swapper

[kaladinlight]

Description

getSwapperConfig() passed a placeholder empty string for VITE_BOB_GATEWAY_API_KEY, so the BOB SDK omitted the auth header entirely:

// @gobob/bob-sdk/dist/gateway/client.js:27
headers: apiKey ? { Authorization: `Bearer ${apiKey}` } : undefined,

Every gateway call therefore went out unauthenticated and came back 403 Forbidden with an HTML body, surfacing as GatewayError: Non-JSON response: HTTP 403 Forbidden in the status poller.

This wires the key through env.ts and getSwapperConfig(), matching how the other swapper keys are declared, and documents it in .env.example.

Validated with z.string().length(32) rather than .min(1) because the SDK hard-rejects any other length at client construction, where it would surface as an unhandled throw rather than a startup error:

if (apiKey && apiKey.length !== 32) throw new Error('apiKey must be exactly 32 characters')

VITE_BOB_GATEWAY_API_KEY must be set in Railway before this merges — it is a required variable, so the service will refuse to start without it.

Two config placeholders remain empty and are deliberately out of scope: VITE_ACROSS_INTEGRATOR_ID (may affect Across affiliate attribution) and VITE_TRON_GRID_API_KEY (Sun.io falls back to TronGrid's public rate limits).

Testing

• 68/68 existing tests pass.
• Confirmed the failure mode against the live API: unauthenticated requests to /v3/get-order/{id} return 403 with a Cloudflare HTML body, matching the observed error signature exactly.
• Loaded src/env.ts directly under ts-node to check schema behaviour, since the test suite mocks the env module wholesale and would not catch a bad schema:
  • with the key present, config resolves it at length 32
  • with it absent, boot fails with Invalid environment variables: ... at VITE_BOB_GATEWAY_API_KEY

The key itself could not be verified end to end from a dev machine — Cloudflare blocks that IP for all requests to gateway-api-mainnet.gobob.xyz, including unauthenticated ones to public endpoints, so the request never reaches the API. Worth watching the first deploy: if BOB swaps still log Non-JSON response: HTTP 403, the block is on the source IP rather than the credential, and BOB would need to allowlist it.

🤖 Generated with Claude Code