feat: simple shared-token api auth

Adds a shared-token auth dependency for the viewing API (Task 2.9). Trust
model: when API_TOKEN is empty (the default) auth is disabled — we trust the
network boundary (local/intranet tool). When set, every request must present
the token via `Authorization: Bearer <token>` or `?token=<token>`, else 401.
`/api/health` is exempt so liveness probes work without the token.

- app/config.py: add `api_token: str = ""` to Settings.
- app/api/auth.py: `require_auth` dependency (secrets.compare_digest, reads
  get_settings() per-request so token rotation via cache_clear() works).
- app/api/main.py: apply the dependency globally; document the trust model.
- .env.example: document API_TOKEN.
- tests/test_api_auth.py: 8 tests covering disabled/correct/missing/wrong/
  malformed-header/query-param/health-exempt paths.

Co-Authored-By: Claude <noreply@anthropic.com>

yunke-server/app/api/main.py

@@ -10,17 +10,25 @@ Includes:
 * ``GET /api/media/{media_hash}`` (see :mod:`app.api.routers.media`).
 
 CORS is configured permissively (wildcard origin, no credentials) so the local
-frontend can call the API during development. Auth / finer CORS are LATER tasks.
+frontend can call the API during development.
+
+Auth (Task 2.9): a single shared-token dependency (:func:`app.api.auth.require_auth`)
+is applied globally on the app. Trust model: when ``Settings.api_token`` is
+empty (the default) auth is disabled — we trust the network boundary (this is a
+local/intranet tool). When a token is configured, every request must present it
+via ``Authorization: Bearer <token>`` or ``?token=``. ``/api/health`` is exempt
+so liveness probes work without the token. See :mod:`app.api.auth`.
 """
 
 from __future__ import annotations
 
-from fastapi import FastAPI
+from fastapi import Depends, FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
+from app.api.auth import require_auth
 from app.api.routers import customer, media
 
-app = FastAPI(title="yunke data mirror")
+app = FastAPI(title="yunke data mirror", dependencies=[Depends(require_auth)])
 
 app.add_middleware(
     CORSMiddleware,