Add optional API key auth to the server

Deployments reachable outside a trusted LAN need some form of access
control. Set FUELISH_API_KEY and the server requires a matching
X-API-Key header on /jobs; unset, behavior is unchanged (no auth).
The Android app gets a matching Settings field. This only checks the
key - TLS termination is left to a reverse proxy in front of the
server, not handled here.

.gitignore

@@ -4,6 +4,9 @@
 # Local registry credentials (see registry.env.example)
 /registry.env
 
+# Local API key for docker-compose.yml's api service (see .env.example)
+/.env
+
 # Local Claude Code settings
 /.claude/settings.local.json