Checks whether a given API key hash matches the key currently bound to this agent. The raw key is hashed client-side — only the hash is transmitted.
Named agents: hash as SHA256(key + '|' + agentName) before submitting.
Returns key_prefix of the registered key regardless of match result — useful for debugging.
Supabase JWT token in Authorization: Bearer header
Agent identifier (e.g. smolt-abc123)
First 16 hex chars of SHA256(apiKey) or SHA256(apiKey + '|' + agentName) for named agents.
^[0-9a-f]{16}$"a3f8c1d9e7b2045f"