validate unsandbox keys before each process and backfill

Keys can have tiers changed or expire mid-run. Now:
- process_karaoke validates keys before downloading from S3
- backfill aborts cleanly if keys are invalid instead of defaulting to 1 worker

make_post_sell/lib/karaoke.py

@@ -34,6 +34,13 @@ def process_karaoke(s3_client, bucket, s3_key, s3_path,
     """
     public_key, secret_key = _resolve_credentials(public_key, secret_key)
 
+    # Validate keys are still active before spending time on S3 download
+    try:
+        validate_keys(public_key, secret_key)
+    except Exception as e:
+        log.warning("Unsandbox API keys invalid or expired — skipping: %s", e)
+        return None
+
     with tempfile.TemporaryDirectory(prefix="karaoke_") as tmpdir:
         # 1. Download original from S3 (get_object, not download_file —
         #    download_file uses boto3 TransferManager which spawns threads
@@ -183,13 +190,13 @@ def backfill_karaoke_async(shop_id, session_factory, app_settings):
 
                 pk, sk = shop.unsandbox_public_key, shop.unsandbox_secret_key
 
-                # Query account concurrency from unsandbox API
+                # Query account concurrency from unsandbox API — abort if keys are bad
                 try:
                     key_info = validate_keys(pk, sk)
-                    concurrency = int(key_info.get("concurrency", 1))
-                except Exception:
-                    concurrency = 1
-                concurrency = max(1, concurrency)
+                    concurrency = max(1, int(key_info.get("concurrency", 1)))
+                except Exception as e:
+                    log.error("Backfill aborted — unsandbox keys invalid or expired for shop %s: %s", shop.name, e)
+                    return
                 log.info("Backfill karaoke for shop %s — %d concurrent workers", shop.name, concurrency)
 
                 # Collect work items