fix(klipper): send X-Api-Key header on all Moonraker requests

[EastArctica]

Root cause

The Klipper adapter accepted an apiKey parameter but ignored it. Its shared Axios client has no default authentication headers, while only the OctoPrint backend attaches credentials per request. Moonraker instances with [authorization] force_logins: True therefore returned 401 Unauthorized for every Klipper-backend call.

Fix

• Send X-Api-Key on all Klipper/Moonraker GET and POST requests.
• Include the key on multipart uploads and authenticated remote-file downloads.
• Preserve unauthenticated behavior when no API key is supplied.

Verification

• npm run build passes.
• The requested STL and Node test commands were run; 450 tests passed and 2 unrelated existing slicer-environment tests failed (FULU Orca slicer aliases export Bambu project 3MF with model preset and empty slicer_path preserves env fallback without enabling executable arguments).
• Live test evidence: Klipper v0.13.0 host with force_logins: True; get_printer_status returned 401 before the fix and printer-ready status JSON after it.

[DMontgomery40]

Thank you, Jack—this was a useful fix! Your Klipper 0.13.0 report and the 401-to-ready evidence identified exactly why authenticated Moonraker installs could not work. Your original commit is now merged through #31, and you’re credited in CONTRIBUTORS.md.

I added loopback regressions covering all nine request paths, including multipart uploads and the remote download used by print inspection. Both API-key and trusted-client configurations pass, and CI is green on Node 18/20/22/24. No maintainer physical print was run.

The fix is now published in 1.2.11. Trusted npm publication succeeded, and a fresh npx installation starts with version 1.2.11 and discovers all 30 MCP tools. Really appreciate the focused contribution and concrete evidence!