Security: implement or confirm service-to-service auth (X-API-Key) for Rails-called routes

[franciszver]

Split out from the broken-access-control remediation (#59, PR #66).

_docs/active/API_CONTRACTS.md documents X-API-Key service-to-service auth for POST /practice/assign, /practice/assign/async, /nudges/check, and /overrides/, and shows the Rails backend calling them with that header. No code has ever read or validated X-API-Key — settings.ai_service_api_key (src/config/settings.py) is declared and unused. Those routes were therefore effectively unauthenticated, which is the vulnerability PR #66 closes.

Consequence of #66: any server-to-server caller relying on unauthenticated access to those routes will now receive 401.

Decide one of:

1. Confirm the Rails caller sends a real (tutor/admin) JWT; update API_CONTRACTS.md to drop the X-API-Key story.
2. Implement the documented X-API-Key path as a scoped service identity that resolves to a specific authorized actor. A blanket key that bypasses ownership would re-open the exact BOLA fix(sec): remediate broken access control (BOLA/IDOR) across API + parent model (#59) #66 closed, so it must NOT skip assert_can_access_student.

Blocks any production reliance on those routes from Rails.

[franciszver]

Research conclusion (2026-07-24): this is a DOC FIX, not a build. No live caller breaks.

Investigated docs, actual callers, and full git history:

• No Rails code has ever existed in this repo. rails_app_url and ai_service_api_key were added in the founding commit b75a736 and never referenced again — dead config. Docs frame Rails as "Optional" / "will call" (future tense), never as a live integration.
• X-API-Key service auth was never implemented server-side, at any point in history. Every X-API-Key occurrence is in docs or unused examples/api-client/ snippets; it never touched src/.
• The real caller today is the React frontend (examples/frontend-starter/), which sends Authorization: Bearer <jwt> on every request. It calls /practice/assign and /practice/assign/async — both already JWT-authenticated, so PR fix(sec): remediate broken access control (BOLA/IDOR) across API + parent model (#59) #66 does not break them.
• /nudges/check and /overrides/ have no real caller at all in the repo (only the unused example snippets). /nudges/check is documented as "called by a scheduled job" with no client identified.
• Docs are internally contradictory (X-API-Key vs Bearer <api_key>; two different env-var names; conflicting owner tables).

Recommendation: resolve as a documentation fix — update API_CONTRACTS.md (+ siblings) to state JWT-only auth, drop the X-API-Key story, and remove the dead ai_service_api_key/rails_app_url settings. PR #66 is safe to merge.

One external check before closing: confirm no deployed cron/scheduler calls POST /nudges/check server-to-server without a JWT (none exists in-repo). If such a scheduler exists, it needs a JWT (or the scoped-service-auth option); if not, nothing breaks.

[franciszver]

Done and merged to main in PR #66 (part of epic #59).