feat!: API keys actually gate the gateway — auth, attribution, rate limits, budgets

The office-readiness audit found the foundation missing: configured API keys
were decorative. Any bearer — or none — passed every model endpoint, per-key
rate limits existed only in the form, and all real traffic was recorded as
"anonymous", leaving the per-key spend table permanently blank.

A middleware on the model surface (/v1/*, /route, /mcp) now enforces keys:
- no keys configured → open mode as before (the console already warns);
- keys exist → Bearer or x-api-key must match (401 invalid_api_key);
- per-key rate_per_min → fixed one-minute window, 429 with Retry-After;
- NEW per-key monthly_budget_usd → 429 insufficient_quota once the account's
  month-to-date spend crosses the ceiling;
- the matched account rides the request into stats — the keys table's spend
  columns finally see real traffic.

Month-to-date spend is tracked per account in stats and persisted in the
totals sidecar with a watermark (no double counting across restarts). The
key dialog gains a budget field; the table shows "budget $N/mo" in red once
exhausted. All verified live: 401 wrong/missing key, 200 + attribution with
the right key, 429 + Retry-After over the limit, 429 insufficient_quota on
the second request past a $0.000001 budget.

Also: the dashboard shows the OpenRouter credit balance (GET
/api/v1/credits via the stored key, cached 5 min, hidden without a key, red
under $5 — live: $16.18), the server drains connections on Ctrl-C instead
of dropping them, request bodies are capped at 32 MB, and docs/DEPLOY(.ru)
cover office deployment: systemd/launchd/Windows service, nginx/caddy TLS,
security checklist, backups. 10 strings ×7 languages.

src/error.rs

@@ -13,6 +13,8 @@ pub enum GatewayError {
     Unauthorized(String),
     #[error("rate limit exceeded")]
     RateLimited { retry_after_secs: u64 },
+    #[error("monthly budget exhausted (limit ${budget_usd})")]
+    BudgetExhausted { budget_usd: f64 },
     #[error("upstream unavailable: {0}")]
     UpstreamUnavailable(String),
     #[error("internal error: {0}")]
@@ -37,6 +39,11 @@ impl GatewayError {
                 "rate_limit_error",
                 "rate_limited",
             ),
+            Self::BudgetExhausted { .. } => (
+                StatusCode::TOO_MANY_REQUESTS,
+                "insufficient_quota",
+                "insufficient_quota",
+            ),
             Self::UpstreamUnavailable(_) => (
                 StatusCode::BAD_GATEWAY,
                 "upstream_unavailable",