Add API keys / bearer tokens for forward auth

Enables server-to-server authentication for forward auth applications
(e.g., video players accessing WebDAV) where browser cookies aren't
available. API keys use clk_ prefixed tokens stored as HMAC hashes.

Bearer token auth is checked before cookie auth in /api/verify.
Invalid tokens return 401 JSON (no redirect). Requests without
bearer tokens fall through to existing cookie flow unchanged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

db/migrate/20260305000001_create_api_keys.rb

@@ -0,0 +1,20 @@
+class CreateApiKeys < ActiveRecord::Migration[8.1]
+  def change
+    create_table :api_keys do |t|
+      t.references :user, null: false, foreign_key: true
+      t.references :application, null: false, foreign_key: true
+      t.string :name, null: false
+      t.string :token_hmac, null: false
+      t.datetime :expires_at
+      t.datetime :last_used_at
+      t.datetime :revoked_at
+
+      t.timestamps
+    end
+
+    add_index :api_keys, :token_hmac, unique: true
+    add_index :api_keys, [:user_id, :application_id]
+    add_index :api_keys, :expires_at
+    add_index :api_keys, :revoked_at
+  end
+end