- Secrets are now added to ApiKeyStore on supervisor initialization - Removed duplicate authentication logic in verify_api_key - Single source of truth: all authentication goes through ApiKeyStore - Admin/user/register secrets are treated as API keys with appropriate scopes - Simplified auth_verify - no special case handling needed