Add API key authentication for /server/* endpoints

[nitrobass24]

Summary

Add optional API key authentication to protect all /server/* REST and SSE endpoints.

Details

Currently the SeedSync web UI and API have zero authentication. Anyone with network access to port 8800 has full control.

Implementation

• Add api_key field to [Web] config section (empty = auth disabled for backward compat)
• Add Bottle before_request hook that checks X-Api-Key header on all /server/* routes
• SSE endpoint (/server/stream) should accept ?api_key= query param as alternative
• Return HTTP 401 when key is missing/invalid
• Angular HttpInterceptor to auto-inject the header
• Settings UI field (masked input) to configure the key

Acceptance Criteria

• API key configurable in settings UI
• All /server/* endpoints reject requests without valid key (when key is set)
• SSE stream works with query param auth
• Empty key = no auth (backward compatible)

[nitrobass24]

Closed via PR #130 merged to develop.