Add optional API key auth to the server

Deployments reachable outside a trusted LAN need some form of access
control. Set FUELISH_API_KEY and the server requires a matching
X-API-Key header on /jobs; unset, behavior is unchanged (no auth).
The Android app gets a matching Settings field. This only checks the
key - TLS termination is left to a reverse proxy in front of the
server, not handled here.

README.md

@@ -157,12 +157,21 @@ is found next to the photo):
 docker compose up -d
 ```
 
+By default this has no auth (fine for a LAN-only setup - see the app's
+`network_security_config.xml` for the HTTP-only/private-IP-range
+restriction this implies). For a deployment reachable outside a trusted
+LAN, copy `.env.example` to `.env`, set `FUELISH_API_KEY` (e.g.
+`openssl rand -hex 32`), and enter the same key in the Android app's
+Settings tab alongside the server URL - every request then needs a
+matching `X-API-Key` header (see `tooling-container/src/server.py`).
+This only checks the key; it doesn't add TLS - put a reverse proxy in
+front of the server for anything public.
+
 Then, in the Android app's Settings tab, point it at
-`http://<this-host>:8080` (both HTTP-only - see the app's
-`network_security_config.xml` - and LAN-only by design, no auth/TLS).
-Take a photo, watch the 4-stage progress (upload → preprocess → OCR →
-extract), correct anything the model got wrong, and save. The Receipts
-tab lists everything saved so far and exports to CSV or `.ods`.
+`http://<this-host>:8080`. Take a photo, watch the progress (upload →
+preprocess+OCR → extract), correct anything the model got wrong, and
+save. The Receipts tab lists everything saved so far and exports to CSV
+or `.ods`.
 
 ## License