Add API key authentication to all endpoints

[byteofhoney]

Currently anyone who knows the API URL can create experiments, log events and read results with no authentication at all.

This needs to be fixed before TesiT is deployed anywhere public.

What needs to be done:

• Generate an API key on first run and store it in the .env file
• All endpoints should require an Authorization header with the key
• Requests without a valid key should return 401
• The dashboard should send the key with every request
• Document how to set the key in the README

Branch off main using: feat/api-key-auth