deploy(S4): Blender headless pipeline + WebAR client + backend fixes

backend/routes/system_routes.py

@@ -62,3 +62,87 @@ async def handle_activation_event(payload: ActivationEventPayload):
     import asyncio
     asyncio.create_task(on_jarvis_friday_activated(payload.persona, payload.trigger_source))
     return {"status": "ok", "message": "Activation sequence initiated"}
+
+
+@router.get("/key_diagnostics")
+async def key_diagnostics(probe: bool = False):
+    """Report, per key domain, whether this runtime can actually resolve its key.
+
+    Answers "does every key work *here*" rather than "is the key string valid" —
+    those are different questions, because get_secret() prefers the environment
+    (HF Space Secrets) and only falls back to the encrypted vault. A key can be
+    perfectly valid at the provider and still be unreachable from the process
+    that needs it.
+
+    Never returns a key value: only presence, length and a fingerprint. With
+    ?probe=true it also makes one real upstream call per distinct key so the
+    result reflects live provider state, not just local resolution.
+    """
+    import hashlib, os, json, urllib.request, urllib.error, urllib.parse
+    from backend.services.usb_vault import KeyDomain, KEY_DOMAIN_ENV_MAP, get_secret
+
+    def fingerprint(v: str) -> str:
+        return hashlib.sha256(v.encode()).hexdigest()[:10]
+
+    def probe_google(key: str):
+        url = ("https://generativelanguage.googleapis.com/v1beta/models?key="
+               + urllib.parse.quote(key))
+        try:
+            with urllib.request.urlopen(url, timeout=20) as r:
+                return {"ok": True, "models": len(json.loads(r.read().decode()).get("models", []))}
+        except urllib.error.HTTPError as e:
+            return {"ok": False, "http": e.code}
+        except Exception as e:
+            return {"ok": False, "err": type(e).__name__}
+
+    domains, seen = [], {}
+    for domain, env_name in KEY_DOMAIN_ENV_MAP.items():
+        value = None
+        try:
+            value = get_secret(env_name)
+        except Exception:
+            value = None
+        entry = {
+            "domain": domain.value,
+            "env_var": env_name,
+            "resolved": bool(value),
+            "source": "env" if os.environ.get(env_name) else ("vault" if value else None),
+            "length": len(value) if value else 0,
+            "fingerprint": fingerprint(value) if value else None,
+        }
+        if probe and value:
+            fp = entry["fingerprint"]
+            if fp not in seen:
+                seen[fp] = probe_google(value)
+            entry["live"] = seen[fp]
+        domains.append(entry)
+
+    nvidia = []
+    for i in range(1, 16):
+        name = f"NVIDIA_API_KEY_{i}"
+        try:
+            v = get_secret(name)
+        except Exception:
+            v = None
+        nvidia.append({"env_var": name, "resolved": bool(v),
+                       "source": "env" if os.environ.get(name) else ("vault" if v else None),
+                       "fingerprint": fingerprint(v) if v else None})
+
+    others = {}
+    for name in ("GEMINI_API_KEY", "HF_API_TOKEN", "SKETCHFAB_TOKEN",
+                 "BRAVE_SEARCH_API_KEY", "SERPAPI_KEY", "VAULT_MASTER_PASSWORD"):
+        try:
+            v = get_secret(name)
+        except Exception:
+            v = None
+        others[name] = {"resolved": bool(v),
+                        "source": "env" if os.environ.get(name) else ("vault" if v else None)}
+
+    return {
+        "domains": domains,
+        "domains_resolved": sum(1 for d in domains if d["resolved"]),
+        "domains_total": len(domains),
+        "nvidia": nvidia,
+        "nvidia_resolved": sum(1 for n in nvidia if n["resolved"]),
+        "other": others,
+    }