build(intake): add the Anthropic SDK and warn when its key is absent (#223)

Both packages go in dependencies rather than devDependencies. The final Docker stage installs with --omit=dev, so the wrong section produces a container that fails on the first submission and nowhere else — which is how sharp went wrong in #226.

ANTHROPIC_API_KEY is a warning, not a requirement. Absent, the container still boots and a submission still arrives, keeps its photos and waits in the queue undrafted. The photos are often the only copy of an item no longer in the sender's hands, so losing a consignment to an expired key would be a worse outcome than an item arriving without its description written. Silence would be wrong too: an operator who believes drafting is on and finds every item undrafted has nothing to tell them why.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/src/envValidation.ts

@@ -162,6 +162,24 @@ function checkAdminGate(env: NodeJS.ProcessEnv): string[] {
   ];
 }
 
+// Optional on purpose, and unlike the two above, unset costs nothing in
+// safety. A submission still arrives, keeps its photos and waits in the queue
+// undrafted (#223). It is a warning rather than an error because the photos are
+// often the only copy of an item no longer in the sender's hands, so losing a
+// consignment to an expired key would be far worse than an item arriving
+// without its description written. Silence would be the wrong answer too: an
+// operator who believes drafting is on and finds every item undrafted has
+// nothing to tell them why.
+function checkDraftingKey(env: NodeJS.ProcessEnv): string[] {
+  if (isPresent(env, 'ANTHROPIC_API_KEY')) {
+    return [];
+  }
+  return [
+    'ANTHROPIC_API_KEY is not set — submitted items will arrive undrafted and wait in the ' +
+      'review queue for someone to write them up by hand.'
+  ];
+}
+
 // Optional, and the same shape as the admin gate above: unset is a working
 // configuration with one defence switched off, which is worth saying out loud
 // rather than leaving to be discovered. Set, it has to be an absolute origin —
@@ -205,6 +223,6 @@ export function validateEnv(env: NodeJS.ProcessEnv): EnvValidation {
       ...mail.errors,
       ...uploads.errors
     ],
-    warnings: [...mail.warnings, ...checkAdminGate(env), ...uploads.warnings]
+    warnings: [...mail.warnings, ...checkAdminGate(env), ...uploads.warnings, ...checkDraftingKey(env)]
   };
 }