AskVibeMarked as helpful by the asker
Treat that key as public and rotate it today. Six weeks on a live domain means it is in browser history, in any proxy log along the way, and quite possibly in a scraper's database. Normal usage so far tells you nothing, because the cost of using someone else's key is zero and the finders are not in a hurry.
The fix is a server route in front of it. The key lives in an environment variable on the server, the browser posts the notes to /api/draft, the route calls the provider and streams the answer back. Same user experience, key never leaves your machine.
While you are writing that route, require a signed-in teacher and count calls per user per day in a table. A proxy without a limit is a public key with extra steps.