Add optional API key auth to the server

Deployments reachable outside a trusted LAN need some form of access
control. Set FUELISH_API_KEY and the server requires a matching
X-API-Key header on /jobs; unset, behavior is unchanged (no auth).
The Android app gets a matching Settings field. This only checks the
key - TLS termination is left to a reverse proxy in front of the
server, not handled here.

docker-compose.yml

@@ -9,6 +9,13 @@
 #
 # Usage: docker compose up -d
 # API reachable at http://<this-host>:8080 from any device on the LAN.
+#
+# For a deployment reachable outside a trusted LAN, copy .env.example to
+# .env and set FUELISH_API_KEY - every /jobs request then needs a
+# matching X-API-Key header (see tooling-container/src/server.py).
+# Unset (the default), the server has no auth, same as before. This
+# server does not terminate TLS itself - put a reverse proxy in front of
+# it for anything public.
 services:
   ollama:
     image: ollama/ollama
@@ -26,6 +33,7 @@ services:
       OLLAMA_URL: http://ollama:11434/api/chat
       OLLAMA_BASE_URL: http://ollama:11434
       OLLAMA_MODEL: qwen2.5:3b
+      FUELISH_API_KEY: ${FUELISH_API_KEY:-}
     command: ["uvicorn", "server:app", "--app-dir", "/opt/app/src", "--host", "0.0.0.0", "--port", "8000"]
     ports:
       - "8080:8000"