/v1/events and /v1/events/{id} require X-API-Key.

The API key is loaded from the API_KEY environment variable.

Per-tenant authorization is not implemented.

Event fields, payload size, and HTTP body size are validated.

Timeout, concurrency limit, load shedding, and bounded queue are enabled.

DATABASE_URL and API_KEY are loaded from environment variables.

Internal errors are logged and generic errors are returned to clients.

Authenticated callers may access arbitrary tenant_id values.