A Drupal API-auth module that fails open: no key generated, no authentication

A Critical advisory for the REST & JSON API Authentication module shows how an enabled gate with no API key configured can let unauthenticated requests through. Here is what SA-CONTRIB-2026-298 says and the one negative test I'd add to every deploy.