export function requireCronSecret(request: Request): void {
  const secret = process.env.CRON_SECRET;
  if (!secret) throw new Response("CRON_SECRET not configured", { status: 500 });
  if (request.headers.get("x-cron-secret") !== secret) {
    throw new Response("Unauthorized", { status: 401 });
  }
}