Support service-authenticated Experience CS project and asset syncs

[abcampo-iry]

Status

• Related to https://github.com/RaspberryPiFoundation/digital-editor-issues/issues/1658
• https://github.com/RaspberryPiFoundation/experience-cs/pull/2344

Points for consideration

Security

• Uses a dedicated service key with constant-time comparison.
• Restricts the service identity to public Scratch projects.
• Rejects user-owned, school-owned, and non-Scratch projects.
• Limits asset uploads to public Code Classroom projects.

Performance

• Checks stored checksums without downloading assets.
• Serializes writes to prevent conflicting or duplicate uploads.

What’s changed?

• Added EXPERIENCE_CS_API_KEY configuration.
• Added authentication through the X-Experience-CS-API-Key header.
• Allowed Experience CS to create and update public Scratch projects.
• Allowed global asset uploads for public Code Classroom projects.
• Made asset uploads idempotent.

Steps to perform after deploying to production

• Deploy Editor API before enabling the Experience CS synchronization.
• Configure EXPERIENCE_CS_API_KEY with a secure secret.
• Configure the same value as EDITOR_API_SYNC_API_KEY in Experience CS.

[github-actions]

Test coverage

93.42% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/32258981638