M1: Wire jobs API + auth middleware into serve path #27

Context

PRD: docs/PRD.md §§7, 11, milestone M1.
Closed slices #6 and #7 landed packages/tests, but cmd/aixgo-sync currently serves only healthz + sessions + messages via internal/server and does not wrap auth.

Goal

Unify the HTTP surface so aixgo-sync serve exposes the full M1 API behind tenant API-key auth.

Out of scope

• Desired-state routes (follow-on)
• Attach / notify / OIDC
• Changing Store semantics

Work

• Mount jobs routes (POST /jobs, GET /jobs/{id}, POST /jobs/{id}/claim) on the process that serve uses
• Wrap /v1/... with internal/auth middleware; keep /healthz open
• Resolve duplicate Server / handler split between internal/api and internal/server so there is one mux path
• Document env: SYNC_API_KEYS required (or optional with clear local-dev behavior) for authenticated routes

Acceptance criteria

• Unauthenticated /v1/... → 401 when keys configured
• Valid key can create/claim a job and GET/PUT a session on the running binary
• Cross-tenant key → 403
• /healthz remains open
• make check green; smoke: go run ./cmd/aixgo-sync serve + curl

Dependencies

Builds on #4–#7 (closed).

How to hand to Aixgo Code

Apply ax:go when ready (prefer first remaining M1 item).