Harden API surface defaults and security advisory tests

[IanFrelinger]

Summary

• add optional API-key middleware for mutating /api/* routes with configurable header and excluded paths
• bind new security options in API startup and log when auth is required but no key is configured
• switch compose port publishing defaults to loopback-only binds for API and Ollama
• add API tests for middleware behavior and exposure-profile advisory mapping/fallback
• update security configuration docs and env examples to match runtime options

Notes

• This PR is opened before post-change test execution to keep an auditable pre-test checkpoint on the branch.

Testing

• Pending targeted test run in follow-up commit/update.