Minimal authenticated peer access (pre-broker): per-workspace credentials, no unauthenticated surfaces

[mortonanalytics]

TerraYield need (FedRAMP-target constraint). The full identity broker (#12, S0–S7) gates brokered SSO, but TerraYield cannot expose an unauthenticated read-only MCP surface even for a demo — it is a FedRAMP Moderate-target app and unauthenticated federation surfaces are a compliance non-starter. The current P0 plan ("read-only, no broker dependency") implicitly assumes exactly that.

Acceptance

• IONe can hold a static per-peer, per-workspace credential (API key / bearer) and present it on every MCP request to that peer.
• Credentials stored encrypted at rest; rotation is a config operation, not a schema change.
• Explicitly documented as the pre-broker mode that Identity broker (S0–S7): gate for TerraYield brokered SSO #12 later supersedes (same peer-side auth header contract, so peers don't rebuild when the broker lands).

TerraYield already has API-key auth (ty-auth) — with this, its MCP surface rides the existing key infrastructure from day one.

[mortonanalytics]

Landed in #23, merged as d38683a. (The PR body's Closes #12, #13, … list only auto-linked #12 — closing the rest manually.)