LLM service: API-key auth for internal callers #41

Sub-issue of #33 (LLM service). Blocked by #40 (scaffold).

Goal

Scoped API-key auth so only known internal callers can use the LLM service, and each request is attributable to a specific consumer (needed later for per-consumer rate limits / usage caps).

Architecture fit

Mirror team-tracking's auth: src/api/auth.py + an auth/audit middleware (see services/team-tracking/src/api/auth.py, middleware.py). Keys live only in this service. Per-consumer identity (e.g. a key label) must be available on the request so #43-style guardrails can key off it.

Tasks

• src/api/auth.py — API-key verification dependency; 401 on missing/invalid key.
• Key storage + a way to mint/label per-consumer keys (reuse team-tracking's approach if practical).
• Attach the resolved consumer identity to the request context.
• Tests: 401 without key, 200 with a valid key, identity surfaced.

Verification

• pytest auth tests green; a request without a key is rejected, a labeled key is accepted and its identity is readable downstream.

Acceptance criteria

• Only valid API keys reach handlers; every authorized request carries a consumer identity. Keys never leave the service.

Blocked by: #40