M1: Tenant API-key auth middleware (stub) #7

Context

PRD: docs/PRD.md §11 (security). Needed before any shared environment.

Goal

Minimal API-key auth middleware: project-scoped keys, hashed at rest in memory/config for tests; reject missing/invalid keys on /v1/... routes; leave /healthz open.

Out of scope

• OIDC / OAuth
• Key management UI
• Persisting keys in S3 (optional later); in-memory or env map is enough for M1

Prerequisites

• HTTP server from sessions issue (or land middleware + wire in same PR if sessions already merged)

Behavior

• Header: Authorization: Bearer <token> (document)
• Env for bootstrap: e.g. SYNC_API_KEYS=org:project:token,... or JSON file path — document format
• Store only hashes in process memory when loading plaintext from env
• On success, context carries org_id, project_id (and optionally key id)
• URL org/project must match authenticated scope → else 403

Acceptance criteria

• Unauthenticated /v1/... → 401
• Wrong key → 401
• Key for orgA cannot read orgB paths → 403
• /healthz remains 200 without auth
• Unit tests with httptest; make check green
• README security section for local/dev keys

Required tests

1. healthz no auth
2. sessions GET without header → 401
3. valid key success
4. cross-tenant 403

Makefile / gate

Unchanged make check.

Dependencies

Best after sessions HTTP stub exists.

How to hand to Aixgo Code

Apply ax:go after sessions API merged (or combine carefully).