Function extract_api_key 

pub fn extract_api_key(headers: &HeaderMap) -> Option<String>

Extracts the API key from request headers.

Checks x-api-key first, then Authorization: Bearer <key>.