Add role-based API key auth

[yashturkar]

Summary

• add DB-backed hashed API keys, caller identity resolution, legacy fallback auth, and a key-management CLI
• route note and publish writes through caller roles instead of a caller-declared source parameter
• refresh kb-server tests and auth docs for role-based behavior

Verification

• ./kb-server/.venv/bin/pytest kb-server/tests -q
• kb-server/.venv/bin/python scripts/docs_lint.py
• env DATABASE_URL=sqlite:////tmp/flight-deck-auth-smoke.db kb-server/.venv/bin/alembic upgrade head
• env DATABASE_URL=sqlite:////tmp/flight-deck-auth-smoke.db kb-server/.venv/bin/python -m app.cli.keys create --name test-user --role user
• env DATABASE_URL=sqlite:////tmp/flight-deck-auth-smoke.db kb-server/.venv/bin/python -m app.cli.keys list
• env DATABASE_URL=sqlite:////tmp/flight-deck-auth-smoke.db kb-server/.venv/bin/python -m app.cli.keys revoke --prefix kbk_e0f6

[yashturkar]

@yashomdighe this one is relative to #6