Add optional API key auth to the server

Deployments reachable outside a trusted LAN need some form of access
control. Set FUELISH_API_KEY and the server requires a matching
X-API-Key header on /jobs; unset, behavior is unchanged (no auth).
The Android app gets a matching Settings field. This only checks the
key - TLS termination is left to a reverse proxy in front of the
server, not handled here.

.env.example

@@ -0,0 +1,7 @@
+# Copy to .env (gitignored, never commit the real value) to require an
+# API key on the server's /jobs endpoint - see docker-compose.yml and
+# tooling-container/src/server.py. Leave FUELISH_API_KEY unset/empty for
+# the original LAN-only/no-auth setup.
+#
+# Generate one with: openssl rand -hex 32
+FUELISH_API_KEY=