AI 에이전트 연동

Integrate the BIZ MORI API for me.

Docs:      https://docs.bizmori.com
Full docs: https://docs.bizmori.com/llms-full.txt          <- guides, in plain text
OpenAPI:   https://docs.bizmori.com/api-reference/openapi.yaml  <- authoritative schemas
Base URL:  https://api.bizmori.com
Auth:      Authorization: Bearer $BIZMORI_API_KEY  (read from env; never hardcode or log it)
Service:   <Anti-AI | Watermark Embed | Watermark Extract | AI Detection>
Stack:     <e.g. TypeScript + Express, Python + FastAPI>
My task:   <what you want built>

Before writing any code, fetch BOTH files above:
- llms-full.txt for the guides — read the quickstart for my service, plus Webhooks
  and Error Codes.
- openapi.yaml for the exact request/response schemas. The guides do NOT contain the
  field definitions, so take every field name, type, enum value, and required/optional
  flag from the spec. Never infer a field from a code sample alone.
Then tell me your plan and anything risky or ambiguous. Do not invent endpoints, fields,
or parameters: if the spec does not have it, say so instead of guessing. If an endpoint
is marked deprecated in the spec, do not use it — use the replacement it names.

The docs specify these, and they are the things that get implemented wrong. Look each
one up rather than assuming — do not ship code that skips them:
- Orders are ASYNCHRONOUS, and the confirm step differs per service. Some services
  require a confirm call after upload; others have no confirm endpoint at all and must
  never receive one. Check which applies to my service before you write the flow.
- Webhook signatures must be verified against the RAW request body, in constant time.
- Presigned upload/download URLs expire, and there is an endpoint to refresh them.
- Order creation takes an idempotency key. Reuse it when retrying.

After you finish, verify — do not just claim it works:
1. Run a real end-to-end order with a test image and show me it reaching `complete`.
2. Show me the result actually retrieved (the downloaded file, or the detection field).
3. Grep your own diff for a hardcoded key or a logged token, and show me the output.
4. If you built a webhook receiver, send it a bad signature and show it returns 401.
If you could not run one of these, say so plainly instead of asserting it passed.