feat: harden gateway with policy engine, secure tools, and governance docs

tests/test_auth.py

@@ -61,7 +61,7 @@ def test_hash_api_key():
     assert hashed == hash_api_key(key)  # Deterministic
 
 
-def test_validator_singleton():
+def test_validator_singleton(mock_env_with_key):
     """Test that get_validator returns same instance."""
     validator1 = get_validator()
     validator2 = get_validator()