fix(auth): support auto-generated temp key in dashboard login

When no MASTER_API_KEY env var is set, AuthManager generates a temp key
but DashboardAuth didn't know about it. Now validate_api_key() also
checks AuthManager as a fallback, so temp key login works for first-time
Docker users.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/dashboard/auth.py

@@ -1,7 +1,5 @@
 """
 Dashboard Authentication - Session-based authentication for Web UI.
-
-Phase K.1: Core Infrastructure
 """
 
 import logging
@@ -91,10 +89,20 @@ class DashboardAuth:
         if not api_key:
             return False, "", None
 
-        # Check master API key
+        # Check master API key (from env var)
         if self.master_api_key and secrets.compare_digest(api_key, self.master_api_key):
             return True, "master", None
 
+        # Check AuthManager's master key (covers auto-generated temp keys)
+        try:
+            from core.auth import get_auth_manager
+
+            auth_mgr = get_auth_manager()
+            if auth_mgr.validate_master_key(api_key):
+                return True, "master", None
+        except Exception as e:
+            logger.debug(f"AuthManager check skipped: {e}")
+
         # Check project API keys with admin scope
         try:
             from core.api_keys import get_api_key_manager

tests/test_dashboard.py

@@ -177,6 +177,27 @@ class TestDashboardAuthValidation:
         assert user_type == "master"
         assert key_id is None
 
+    def test_temp_key_via_auth_manager(self, auth, monkeypatch):
+        """Should accept temp key from AuthManager when no env MASTER_API_KEY."""
+        from core.auth import AuthManager
+
+        # Simulate AuthManager with a temp key that DashboardAuth doesn't know about
+        temp_key = "temp-generated-key-12345"
+        mgr = AuthManager.__new__(AuthManager)
+        mgr.master_api_key = temp_key
+        mgr._is_temporary_key = True
+        mgr.project_keys = {}
+
+        monkeypatch.setattr("core.auth.get_auth_manager", lambda: mgr)
+
+        # DashboardAuth has master_api_key=None (no env var)
+        auth_no_env = DashboardAuth(secret_key="test-secret", master_api_key=None)
+
+        is_valid, user_type, key_id = auth_no_env.validate_api_key(temp_key)
+        assert is_valid is True
+        assert user_type == "master"
+        assert key_id is None
+
     def test_invalid_key_rejected(self, auth):
         """Should reject invalid API key."""
         is_valid, user_type, key_id = auth.validate_api_key("wrong-key")