fix 401

src/app/(main)/api/internal/social-milestones/route.ts

@@ -5,9 +5,13 @@ import { isSocialChannel, SOCIAL_CHANNELS, SocialChannel } from '@/lib/social-mi
 
 export const dynamic = 'force-dynamic';
 
+// The worker trims its own copy of the secret before sending it, so a stray
+// trailing space or CR in the compose env file would otherwise show up here as a
+// permanent 401 while both sides still look identical in a hash comparison.
 function isAuthorized(request: NextRequest) {
-  const secret = process.env.INTERNAL_API_SECRET;
-  return Boolean(secret) && request.headers.get('authorization') === `Bearer ${secret}`;
+  const secret = process.env.INTERNAL_API_SECRET?.trim();
+  const presented = request.headers.get('authorization')?.trim().replace(/^Bearer\s+/i, '');
+  return Boolean(secret) && presented === secret;
 }
 
 function approvalDelayHours() {