feat(esm_catalog): PR-B4 — federation API (/catalogs CRUD + auth middleware)

[siligam]

Summary

Provenance: this implementation is substantially Paul Gierz's work, carried over from his esm-tools-plus/simcat/pgierz-workbench prototype branch (commits Mar–Apr 2026). This PR ports it, largely as-is, into the reviewable stack.

• Adds auth.py: Authenticator ABC + NoAuthenticator / APIKeyAuthenticator / JupyterHubAuthenticator implementations
• Adds catalog_routes.py: full CRUD for /catalogs (GET list, GET by ID, POST add, PATCH update, POST refresh, DELETE remove); auth-gated; invalidates queryables cache on mutations
• Wires create_catalog_router(registry, pool, auth, queryables_cache) into create_app(), which now accepts an optional authenticator parameter (defaults to NoAuthenticator / open access)
• 16 new tests covering every endpoint + edge cases (duplicate 409, missing 404, status active/missing)

Test plan

• pytest src/esm_catalog/tests/test_api_federation.py — 16 tests
• pytest src/esm_catalog/tests/ — 129 total tests green
• CI workflow esm-catalog-tests passes on Python 3.9 + 3.12

Stack position

release → PR-0 → A1a → A1b-1 → A1b-2 → A2 → A3 → A4 → B1 → B2 → B3 → B4 (this PR)

🤖 Generated with Claude Code

[siligam]

Rebased onto the corrected PR-0 base (#1483) — test relocation to tests/test_esm_catalog/, restored dedicated CI workflow at the new path, and a couple of CI fixes (doctest-collection exclusion, eval_type_backport for pydantic on Python 3.9). No change to this PR's own diff/scope. CI is green.