Implement persistent API-key authentication

Protect the research lifecycle with X-API-Key validation backed by persistent user and key records. Store only salted scrypt hashes, support expiry and revocation, and expose a local admin CLI for create/list/revoke workflows.

Initialize only the authentication schema at startup, prevent SQL echo from exposing sensitive bound values, and keep health probes public. Add coverage for valid, missing, invalid, expired, and revoked keys.

Document deployment and key administration, update the local CLI to send NSCT_API_KEY, and record the reset handoff state.

tests/test_rest_research.py

@@ -18,8 +18,12 @@ from fastapi.testclient import TestClient
 def client() -> Generator[TestClient, None, None]:
     """Synchronous test client."""
     from nsct.api.main import create_app
+    from nsct.security.api_keys import require_api_key
 
     app = create_app()
+    # The lifecycle tests exercise research behavior, not authentication.  API
+    # key behavior has its own integration tests below.
+    app.dependency_overrides[require_api_key] = lambda: None
     with TestClient(app) as c:
         yield c
 
@@ -453,4 +457,4 @@ def test_load_missing_run_raises_404(client: TestClient) -> None:
 
     with pytest.raises(HTTPException) as exc_info:
         _load_run("non-existent-id")
-    assert exc_info.value.status_code == 404
+    assert exc_info.value.status_code == 404