feat: enforce API key authentication on all data routes

[ajainvivek]

Summary

• API key auth middleware: All /v1/* routes now require a valid API key or master key when REASONDB_AUTH_ENABLED=true. Public paths (/health, /metrics, /swagger-ui, /api-docs) bypass auth so monitoring and docs stay accessible
• FromRequestParts impl: AuthenticatedKey can be used as an axum extractor in route handlers directly
• Terraform null_resource updater: terraform apply now SSHes into the running instance and hot-swaps the Docker container whenever reasondb_image, LLM config, or auth settings change — no need to taint/recreate the EC2 instance
• New Terraform variables: auth_enabled (bool), master_key (sensitive), ssh_private_key_path

How auth works

# Blocked — no key
curl http://<ip>:4444/v1/tables
# → 401 {"error":"authentication_error","message":"API key required..."}

# Allowed — master key
curl -H "Authorization: Bearer rdb_master_..." http://<ip>:4444/v1/tables

# Allowed — scoped API key (created via POST /v1/auth/keys)
curl -H "Authorization: Bearer rdb_test_..." http://<ip>:4444/v1/query

Test plan

• REASONDB_AUTH_ENABLED=false — all routes still work without a key (backward compatible)
• REASONDB_AUTH_ENABLED=true, no key → 401 on any /v1/* route
• REASONDB_AUTH_ENABLED=true, wrong key → 401
• REASONDB_AUTH_ENABLED=true, master key → 200
• REASONDB_AUTH_ENABLED=true, valid API key → 200
• /health, /metrics, /swagger-ui accessible without any key when auth is enabled
• terraform apply after changing reasondb_image in tfvars SSHes in and restarts the container