feat: require an api key to schedule

web/schedule.html

@@ -117,6 +117,11 @@
         <i class="fa-solid fa-flask me-1"></i> Sandbox mode is active — texts are tagged as a test and excluded from
         cost calculations.
       </div>
+      <div id="noApiKeyBanner" class="alert alert-danger"
+        style="display:none;font-size:0.85rem;font-weight:600;text-align:center;">
+        <i class="fa-solid fa-circle-exclamation me-1"></i> No Clickatell API key configured —
+        <a href="index.html" class="alert-link">set one in Admin settings</a> before scheduling.
+      </div>
 
       <div class="page-header">
         <h1>Schedule</h1>
@@ -161,7 +166,7 @@
           <option value="" disabled selected>Loading templates…</option>
         </select>
 
-        <button class="btn btn-primary" onclick="addSchedule()">
+        <button class="btn btn-primary" id="addScheduleBtn" onclick="addSchedule()">
           <i class="fa-solid fa-plus me-1"></i> Add to Schedule
         </button>
       </div>
@@ -516,6 +521,16 @@
     }
     checkAuth();
     document.addEventListener('visibilitychange', () => { if (document.visibilityState === 'visible') checkAuth(); });
+
+    async function checkApiKey() {
+      try {
+        const r = await fetch('/api/settings.php?key=clickatell_api_key').then(res => res.json());
+        const missing = !r.set;
+        document.getElementById('noApiKeyBanner').style.display = missing ? '' : 'none';
+        document.getElementById('addScheduleBtn').disabled = missing;
+      } catch { }
+    }
+    checkApiKey();
   </script>
 </body>