excel file update

app/main.py

@@ -205,7 +205,8 @@ if API_CORS_ORIGINS and all(
 _auth_cfg = auth_config_summary()
 logger.info(
     "Auth config: enabled=%s allow_any_login=%s admin_username=%r "
-    "hash=%s/%s fingerprint=%s source=%s (username source=%s)",
+    "hash=%s/%s fingerprint=%s source=%s (username source=%s) "
+    "api_keys=%d/%s %s",
     _auth_cfg["enabled"],
     _auth_cfg["allow_any_login"],
     _auth_cfg["admin_username"],
@@ -214,6 +215,11 @@ logger.info(
     _auth_cfg["password_hash_fingerprint"] or "(none)",
     _auth_cfg["password_hash_source"],
     _auth_cfg["admin_username_source"],
+    _auth_cfg["api_keys_count"],
+    _auth_cfg["api_keys_source"],
+    # Names, not secrets. A key added to .env.production but only restarted into
+    # a running container never appears here - which is the whole point.
+    [k["name"] for k in _auth_cfg["api_keys"]] or "(none)",
 )
 if cleaned_env_names():
     logger.warning(