Add scoped API key auth for Gateway gRPC

[PurpleTheBest]

Summary

• Bearer-token auth on SolverService + ExecutionService via opaque tsk_<env>_<random> tokens (~52 chars).
• Scopes: read, reveal, wallet.execute:{address}, wallet.execute:*.
• Token prefix is a hard environment scope (not a label) — tsk_test_* keys can only operate on testnet networks, tsk_live_* only on mainnet. GetRoutes/GetQuote filter or reject on env mismatch; SubmitTransaction/RevealSecret/GetOrder/GetTransactionStatus reject.
• DB stores SHA-256(token); raw value is shown once at creation, never retrievable afterwards.
• In-memory cache with absolute 60s TTL — revocation propagates within one window.
• AdminAPI CRUD at /api/api-keys, AdminPanel page at /api-keys with one-time token display.
• Full design notes in .claude/rules/api-key-auth.md.

Components

• Data: ApiKey entity, IApiKeyRepository/EFApiKeyRepository, DbSet<ApiKey> with unique index on KeyHash.
• Service: IApiKeyService/ApiKeyService (transient), singleton ApiKeyCache. Token gen via RandomNumberGenerator.GetBytes(32) + base64url. SHA-256 digest stored.
• gRPC: ApiKeyAuthInterceptor registered globally on AddGrpc. ApiKeyContextExtensions (RequireScope, RequireWalletExecute, RequireMatchingEnv) called per method.
• AdminPanel: ApiKeys.razor with create/view/revoke/delete and a one-time copy modal for the raw token.

DB migration

Schema change adds ApiKeys table with unique indexes on KeyHash and Name. EF migration left for the user to generate per project convention.

Test plan

• dotnet ef migrations add AddApiKeys and apply.
• Create a tsk_test_* key with read scope via AdminPanel → call GetRoutes → verify only testnet routes returned.
• Same key call GetQuote with mainnet networks → expect PermissionDenied.
• Create a tsk_live_* key with wallet.execute:0xABC... → call SubmitTransaction for that wallet on a mainnet network → succeeds.
• Same key call SubmitTransaction for a testnet network → expect PermissionDenied.
• Revoke a key, confirm rejection within 60s (cache window).

🤖 Generated with Claude Code