feat: support per-request API key for runtime inspection clients

[mevinmathew23]

What

Adds an optional api_key argument to every runtime inspection method (Chat sync/async, HTTP, and MCP clients), allowing callers to override the API key on a per-request basis. Clients can also now be constructed without a key for purely per-request usage.

Why

The AI Defense API authenticates each call with an HTTP header (X-Cisco-AI-Defense-API-Key) stamped onto every request — the key is inherently per-request and not bound to a connection or session. The SDK, however, pinned the key at client construction (self.auth), forcing one client (and one connection pool) per key.

This is limiting for multi-tenant services and key-rotation scenarios, where a single shared client should be able to authenticate different calls with different keys without rebuilding the client or its connection pool each time. Per-request auth override is a well-established pattern (requests/httpx per-call headers=/auth=, Stripe's per-call api_key=).

How

Auth is now resolved per call via a small _resolve_auth(api_key) helper on the base inspection clients:

• A per-request api_key takes precedence over the construction-time key.
• When omitted, it falls back to the construction-time key (unchanged behavior).
• When neither is available, it raises a clear ValidationError at call time.

The transport layer already accepted per-call auth, so no request-handler or auth-class changes were needed.

client = ChatInspectionClient(api_key=DEFAULT_KEY)
client.inspect_prompt("hi")                      # uses DEFAULT_KEY (unchanged)
client.inspect_prompt("hi", api_key=TENANT_KEY)  # per-request override

keyless = ChatInspectionClient()                 # no key at construction
keyless.inspect_prompt("hi", api_key=TENANT_KEY) # works

Backwards compatibility

Fully backwards compatible — all new parameters default to None and existing call sites are unaffected.

Tests

Adds tests/test_per_request_api_key.py covering per-call override, fallback, no-key construction, the no-key-anywhere error, and invalid-key validation, parameterized across the sync chat/HTTP/MCP clients plus the async chat client. Full existing suite remains green.

🤖 Generated with Claude Code