feat(upload): support Flight Review API keys and harden reachability

[dakejahl]

Summary

Third of three stacked PRs replacing #28. Based on #30, which is based on #29 — review those first; this diff will shrink to a single commit once they merge.

Carries over adc72da from #28, rebased onto the FTP work, with one change: it no longer blacklists on 401/403 (see below). Authorship preserved.

Problem

The ARK Flight Review fork authenticates automated uploads with a per-account API key (app/tornado_handlers/api_key.py) and rejects unauthenticated uploads with 403. logloader has no way to present a key, so it cannot upload there at all.

Separately, server_reachable() required HTTP 200, but Flight Review's home page answers 302 — so a perfectly healthy review.arkelectron.com was treated as down.

Solution

Optional remote_api_key in config.toml, sent as both Authorization: Bearer <key> and X-API-Key: <key>, matching what the server accepts. Unused by default: when the key is empty no auth headers are sent at all and open servers like logs.px4.io keep working exactly as before. Whitespace-only keys are trimmed to empty so a stray space cannot produce an empty Bearer header. The local server interface never sends a key — flight-review on the companion is open.

Reachability now accepts any HTTP response as proof the host is up, rather than only 200.

Change from #28

adc72da also added 401 and 403 to the permanent blacklist. Dropped here: those statuses mean this account is not authorized yet, not this log is bad. The expected first-run state — upload_enabled = true before the key is configured — returns 403, so blacklisting would silently and permanently discard one pending log per cycle, and they would never upload after the key was set. The blacklist stays 400-only.

The batch-stop on 401/403 in upload_pending_logs is kept, which is the right mechanism: it stops the cycle without destroying state, and uploads resume on their own once the key is valid.

[dakejahl]

Superseded by #32, which contains this branch's commits unchanged and with authorship intact — merging #32 merges this.

Reviewing this stack turned up structural problems in the code underneath it, and fixing those meant rewriting the parts these PRs sit on. Keeping them open would have meant reviewing #29's ServerInterface changes and then reviewing their replacement in the same sitting, so it is one branch now.

Nothing here is dropped: the FTP transport, the reachability cooldown and the API-key headers are all in #32. The one deliberate change is that 401/403 no longer blacklist a log — see the note in #32.