Validate the API key in x-api-key as the caller would use it: it exists, is active, is not expired and — when the key has an IP allow list — the calling address is in it. Always 200; isSuccess=false carries reason: MISSING_HEADER | NOT_FOUND | INACTIVE | EXPIRED | IP_NOT_ALLOWED.