fix(relay): add authorization guard to api/_relay.js and dedupe military baseUrl call (#1992)

api/_relay.js was missing the RELAY_AUTH_HEADER=Authorization guard from
server/_shared/relay.ts: when set, Undici merges both 'authorization: secret'
and 'Authorization: Bearer secret' into 'secret, Bearer secret', breaking the
relay's direct-compare auth check. Apply the same relayHeader !== 'authorization'
guard.

Military handler was calling getRelayBaseUrl() twice (truthy check + string
concat). Store result in relayBase to avoid the double env read and regex eval.

api/_relay.js

@@ -16,7 +16,9 @@ export function getRelayHeaders(baseHeaders = {}) {
   if (relaySecret) {
     const relayHeader = (process.env.RELAY_AUTH_HEADER || 'x-relay-key').toLowerCase();
     headers[relayHeader] = relaySecret;
-    headers.Authorization = `Bearer ${relaySecret}`;
+    if (relayHeader !== 'authorization') {
+      headers.Authorization = `Bearer ${relaySecret}`;
+    }
   }
   return headers;
 }

server/worldmonitor/military/v1/list-military-flights.ts

@@ -78,9 +78,8 @@ export async function listMilitaryFlights(
       REDIS_CACHE_TTL,
       async () => {
         const isSidecar = (process.env.LOCAL_API_MODE || '').includes('sidecar');
-        const baseUrl = isSidecar
-          ? 'https://opensky-network.org/api/states/all'
-          : getRelayBaseUrl() ? getRelayBaseUrl() + '/opensky' : null;
+        const relayBase = isSidecar ? null : getRelayBaseUrl();
+        const baseUrl = isSidecar ? 'https://opensky-network.org/api/states/all' : relayBase ? relayBase + '/opensky' : null;
 
         if (!baseUrl) return null;
 

tests/shared-relay.test.mjs

@@ -256,7 +256,7 @@ describe('relay.ts — consumer import verification', () => {
       'military: must use getRelayBaseUrl() to avoid wss:// URL bug',
     );
     assert.ok(
-      src.includes("getRelayBaseUrl() + '/opensky'"),
+      src.includes('getRelayBaseUrl()') && src.includes("'/opensky'"),
       'military: must use getRelayBaseUrl() for relay URL construction',
     );
   });