feat: client authentication and per-user quota

[Oaklight]

Summary

Add client authentication to the gateway with per-user rate limiting and usage tracking.

Requirements

Authentication

• API key validation via x-api-key header
• Configurable auth modes: api_key, jwt, none (default)
• Key whitelist or signature validation

Per-User Quota

• Track usage per API key
• Configurable per-key rate limits
• Usage stats exposed in admin panel

CORS Hardening

• Replace allow_origins=["*"] with configurable origins
• Default to restrictive in production

Key Files

• src/llm_rosetta/gateway/app.py — middleware
• src/llm_rosetta/gateway/config.py — auth config
• New: src/llm_rosetta/gateway/auth.py — auth logic