API Key generation and usage

[WolfgangFahl]

For the computer controled access the authorization and authentication issue needs to be taken into account.
As a first step generating an API Key within a project might be a good start.

[WolfgangFahl]

State-of-the-art API key implementations to reference:

• PyPI Trusted Publishing (OIDC, 15-min tokens): https://docs.pypi.org/trusted-publishers/
• GitHub CLI (gh auth token, 8-hour on-demand): https://cli.github.com/manual/gh_auth_token
• HashiCorp Vault (revocable, policy-bound tokens): https://developer.hashicorp.com/vault/docs/auth/token
• Supabase (role-embedded JWT keys): https://github.com/supabase/supabase
• Fly.io API tokens (30-day expiry, org-scoped): https://fly.io/docs/flyctl/auth-login/
• Stripe API keys (prefixes for env, scoped permissions): https://stripe.com/docs/keys
• PlanetScale API tokens (role-based, audit logs): https://planetscale.com/docs/concepts/service-tokens