Allow header-based invite auth for seeding over HTTP.

Secure cookies blocked the seed script against the LAN port; X-Stork-Invite + display-name headers fix that.

tests/test_api.py

@@ -103,3 +103,19 @@ def test_second_voter_ranking(client: TestClient, authed: TestClient) -> None:
     listed = client.get("/api/names?kind=first").json()["items"]
     assert listed[0]["score"] == 2
     assert listed[0]["vote_count"] == 2
+
+
+def test_header_auth_without_cookies(client: TestClient) -> None:
+    headers = {
+        "X-Stork-Invite": "test-invite-token",
+        "X-Stork-Display-Name": "Seed Bot",
+    }
+    res = client.post(
+        "/api/names",
+        headers=headers,
+        json={"kind": "first", "spelling": "HeaderOnly"},
+    )
+    assert res.status_code == 200
+    listed = client.get("/api/names?kind=first", headers=headers)
+    assert listed.status_code == 200
+    assert any(n["spelling"] == "HeaderOnly" for n in listed.json()["items"])