refactor(security): Change X-Tool-Server-API-Key header to apiKey

dap-gateway/src/main/java/io/shinhanlife/dap/mcg/service/ExecuteService.java

@@ -261,6 +261,10 @@ public class ExecuteService {
                     Map<String, String> headers = new java.util.HashMap<>();
                     headers.put("trace-id", context.requestId());
                     headers.put("request-id", java.util.UUID.randomUUID().toString());
+                    String apiKey = properties.toolServerApiKey();
+                    if (apiKey != null && !apiKey.isEmpty()) {
+                        headers.put("apiKey", apiKey);
+                    }
                     
                     ObjectNode pageArguments = paginationValidator.normalize(metadata, arguments);
                     LargeToolResponseService.Collector collector = largeResponses.newCollector(metadata.getName(), context.requestId());

dap-was-lib/src/main/java/io/shinhanlife/dap/lib/mcp/security/ApiKeyInterceptor.java

@@ -39,7 +39,7 @@ public class ApiKeyInterceptor implements HandlerInterceptor {
             return true;
         }
 
-        String apiKey = request.getHeader("X-Tool-Server-API-Key");
+        String apiKey = request.getHeader("apiKey");
         Map<String, String> validApiKeys = securityProperties.getApiKeys();
 
         // 2. 만약 프로퍼티에 API Key가 하나도 설정되어 있지 않다면 (개발/로컬 환경 등) 인증 없이 통과시킵니다.