feat: add Bearer token API key authentication

[onurgoz]

Summary

• Add --api-key <KEY> CLI flag and OCULOS_API_KEY env var for API authentication
• Auto-generate a cryptographically secure key (oculos_<32-byte hex>) when none is provided
• Axum middleware layer enforces Authorization: Bearer <KEY> on all HTTP endpoints (/windows/**, /interact/**, /hwnd/**, /health, /ws)
• Browser WebSocket connections authenticated via ?token=<KEY> query parameter (since browser WS API cannot send custom headers)
• Dashboard login screen with localStorage persistence; 401 responses trigger automatic logout
• Constant-time key comparison to prevent timing side-channel attacks
• Fail-closed auth design (returns 500 if auth layer is misconfigured)
• MCP mode (--mcp) bypasses auth entirely (stdin/stdout, no network involved)
• Recorder-exported scripts (Python/JS/curl) include auth headers
• README updated with full Authentication section and all curl examples updated

Changed files

File	Change
Cargo.toml	Added rand = "0.8" dependency
src/auth.rs	New — key generation, auth middleware, constant-time compare
src/main.rs	--api-key CLI arg, env var, wiring
src/api/mod.rs	Middleware + Extension layer on router
src/api/ws.rs	Updated doc comments
static/index.html	Login overlay, auth headers on all fetches/WS, 401 handling
README.md	Auth section, updated curl examples, API table auth note

Test plan

• cargo build compiles without errors on all 3 platforms
• Start without --api-key → random key printed to console
• Start with --api-key mykey → "Using provided API key" logged
• Start with OCULOS_API_KEY=mykey → same behavior
• curl http://localhost:7878/windows → 401 Unauthorized
• curl -H "Authorization: Bearer <key>" http://localhost:7878/windows → 200 OK
• Dashboard shows login screen on first visit
• Wrong key → "Invalid API key" error shown
• Correct key → dashboard loads, key saved in localStorage
• Refresh page → auto-login with saved key (no login screen)
• WebSocket connects with ?token= and receives events
• --mcp mode works without any auth prompts
• After server restart with new key → dashboard shows 401, login screen reappears