feat(auth): add scoped API keys for Astra

[loveRhythm1990]

What type of PR is this?

• feat (new feature)
• fix (bug fix)
• docs (documentation)
• style (formatting, no code change)
• refactor (code change that neither fixes a bug nor adds a feature)
• perf (performance improvement)
• test (adding or updating tests)
• chore (maintenance, tooling)
• build / ci (build or CI changes)

Which issue(s) this PR fixes

Related: #245

This reference intentionally does not automatically close the cross-repository issue.

What this PR does / why we need it

Provide reusable, least-privilege credentials for Astra account sign-in and optional memory sharing.

• Add API-key scopes and stable GET /auth/whoami identity metadata.

• Enforce identity/read/write/key-management scopes across REST and MCP.

• Prevent identity-only/read-only/read-write connection keys from administering groups, managing keys, or reaching unclassified authenticated routes.

• Preserve scopes during rotation and maintain explicit compatibility for legacy/default keys.

• Reject unauthorized memory access before per-user memory provisioning.

• Make whoami verify the current database grant rather than trust a warm replica-local cache, so login/refresh observes revocation made through another API replica.

• Decouple MCP authorization from metrics invalidation. Explicitly require memory:write for memory_apply, memory_rebuild_index and memory_tune_params.

• Classify exact dispatch names rather than sanitized tracking labels; reject unclassified tools by default, including with master credentials.

• Apply the same admission to requests and notifications, with real HTTP/database regression coverage.

Verification

Latest MCP review-fix update (58744ff)

• cargo test --locked -p memoria-api --lib: 93 passed.
• cargo test --locked -p memoria-api --test api_e2e test_scoped_ -- --nocapture: 3 passed.
• cargo test --locked -p memoria-api --test api_e2e test_mcp_ -- --nocapture: 16 passed.
• HTTP tests used isolated local MatrixOne databases. The new regression checks all three missed write tools, notification handling, write-authorized positive controls, readable tools, identity-only denial and unknown/malformed names.
• Persisted-state assertions confirm denied requests/notifications do not tune retrieval parameters, while the same write-authorized operation does.
• Targeted Rust formatting and git diff --check: passed.
• No user test data was cleared or local Memoria service replaced.

Previously recorded verification

Local validation before push:

• Memoria API compile checks and targeted auth/MCP scope unit tests passed.
• Real-database scoped-key API tests passed, including group-administration denial and uncached whoami revocation.
• Seven legacy API-key regression tests passed.
• Astra-to-real-Memoria API v1 contract passed for identity-only, read-only, read-write, master-key rejection, stable account identity and revocation.
• Latest upstream main was merged; its intervening changes have no net source-tree delta relative to the tested Memoria implementation.
• git diff --check passed.

Production OAuth and GitOps deployment are not covered by these API tests.

Cross-repository dependencies

• Astra login, scoped credential lifecycle and user models: feat(auth): connect Memoria identity and scoped memory Astra#704
• Website follow-up (login separated from memory sharing and local testing): https://github.com/matrixorigin/memoria-website/pull/216
• Initial website integration, already merged: https://github.com/matrixorigin/memoria-website/pull/213

No MatrixOne source changes are included.