Add management API key authentication

[quangshuynh]

Summary

Adds database-backed management API keys and protects the management API while keeping public form ingestion unchanged.

Included

• server-generated hym_live_ management API keys
• SHA-256 digest-only credential storage
• reusable FastAPI bearer authentication
• authenticated POST /endpoints
• CLI key creation, listing, and revocation
• immediate revocation semantics
• optional last-used tracking
• migration 0002
• PostgreSQL migration upgrade/downgrade coverage
• authentication and secret-leak tests

Security model

• GET /health remains public
• POST /f/{endpoint_id} remains public
• management credentials are shown only when created
• plaintext API keys are never stored
• malformed, unknown, and revoked keys do not reveal key existence
• incoming management authorization is never forwarded to webhook destinations

Current limitations

• service-wide keys only, no users or tenant ownership
• no key rotation beyond create + revoke
• no endpoint management beyond creation
• no delivery inspection or manual replay
• partial SSRF protection remains