Add API authentication & per-tenant quotas

[las7]

Problem

No auth or per-client isolation; one user can starve the system.

Proposed change

• API keys or JWT auth.
• Per-tenant limits:
  • concurrent jobs
  • CPU / memory
  • runtime
  • queue depth

Acceptance criteria

• Requests without auth are rejected.
• Quotas enforced at queue and executor layers.

[las7]

Partial implementation landed in PR #54: optional API key auth is now available via api_auth_enabled/api_keys/api_auth_header, protected routes reject missing or invalid keys when enabled, Bearer tokens are supported, and rate limiting uses a non-secret per-key identity instead of only client IP. Remaining work for this issue: true per-tenant quota controls for concurrent jobs, queue depth, CPU/memory budgets, and executor-layer quota enforcement.