fix(rest): fail-closed when API key is not configured

[hiroshitanaka-creator]

Motivation

• The API guard previously skipped authentication when PO_API_KEY was empty, which left network-exposed endpoints unauthenticated by default.
• The change enforces a fail-closed behavior so a misconfigured deployment cannot be used without explicit operator action.

Description

• Change require_api_key in src/po_core/app/rest/auth.py to only bypass when skip_auth=True and to raise 503 Service Unavailable when auth is enabled but api_key is empty instead of allowing access.
• Preserve the existing 401 Unauthorized response for invalid or missing client keys when an API key is configured.
• Add a regression unit test test_reason_auth_returns_503_when_key_not_configured to tests/unit/test_rest_api.py that verifies protected endpoints return 503 when skip_auth=False and api_key is unset.

Testing

• Ran pytest -q tests/unit/test_rest_api.py -k "auth" and the selected REST authentication tests passed (5 passed).
• Ran the full test suite with pytest -q; the run completed but two benchmark timing tests failed in this environment: tests/benchmarks/test_pipeline_perf.py::test_bench_concurrent_warn_requests and tests/benchmarks/test_pipeline_perf.py::test_bench_deliberation_scaling, which are unrelated timing-sensitive benchmarks and do not affect the auth regression fix.
• The added unit test ensures the auth bypass cannot be reintroduced silently in future changes.

---

Codex Task