feat!: API keys actually gate the gateway — auth, attribution, rate limits, budgets

The office-readiness audit found the foundation missing: configured API keys
were decorative. Any bearer — or none — passed every model endpoint, per-key
rate limits existed only in the form, and all real traffic was recorded as
"anonymous", leaving the per-key spend table permanently blank.

A middleware on the model surface (/v1/*, /route, /mcp) now enforces keys:
- no keys configured → open mode as before (the console already warns);
- keys exist → Bearer or x-api-key must match (401 invalid_api_key);
- per-key rate_per_min → fixed one-minute window, 429 with Retry-After;
- NEW per-key monthly_budget_usd → 429 insufficient_quota once the account's
  month-to-date spend crosses the ceiling;
- the matched account rides the request into stats — the keys table's spend
  columns finally see real traffic.

Month-to-date spend is tracked per account in stats and persisted in the
totals sidecar with a watermark (no double counting across restarts). The
key dialog gains a budget field; the table shows "budget $N/mo" in red once
exhausted. All verified live: 401 wrong/missing key, 200 + attribution with
the right key, 429 + Retry-After over the limit, 429 insufficient_quota on
the second request past a $0.000001 budget.

Also: the dashboard shows the OpenRouter credit balance (GET
/api/v1/credits via the stored key, cached 5 min, hidden without a key, red
under $5 — live: $16.18), the server drains connections on Ctrl-C instead
of dropping them, request bodies are capped at 32 MB, and docs/DEPLOY(.ru)
cover office deployment: systemd/launchd/Windows service, nginx/caddy TLS,
security checklist, backups. 10 strings ×7 languages.

src/state.rs

@@ -66,6 +66,42 @@ impl Live {
     }
 }
 
+/// Fixed-window per-key rate limiter (minute buckets). Small and honest:
+/// at minute boundaries a burst can briefly see up to 2× the limit, which is
+/// fine for office-grade fairness and costs one HashMap lookup per request.
+#[derive(Default)]
+pub struct RateWindows {
+    inner: std::sync::Mutex<std::collections::HashMap<String, (u64, u32)>>,
+}
+
+impl RateWindows {
+    pub fn allow(&self, key: &str, per_min: u32) -> bool {
+        let minute = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap_or_default()
+            .as_secs()
+            / 60;
+        let mut g = self.inner.lock().unwrap();
+        let e = g.entry(key.to_string()).or_insert((minute, 0));
+        if e.0 != minute {
+            *e = (minute, 0);
+        }
+        if e.1 >= per_min {
+            return false;
+        }
+        e.1 += 1;
+        true
+    }
+    /// Seconds until the current minute window rolls over.
+    pub fn retry_after_secs(&self) -> u64 {
+        60 - (std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap_or_default()
+            .as_secs()
+            % 60)
+    }
+}
+
 pub struct AppState {
     pub live: ArcSwap<Live>,
     pub stats: Arc<Stats>,
@@ -85,6 +121,8 @@ pub struct AppState {
     /// Managed local CMF model server (install/update/spawn lifecycle + status).
     pub cmf: Arc<crate::cmf_runtime::CmfRuntime>,
     pub cache: Arc<SemanticCache>,
+    /// Per-API-key fixed-window rate limiter.
+    pub rate: RateWindows,
     pub secrets: SecretStore,
     pub config_path: String,
     pub pipeline: crate::pipeline::Pipeline,
@@ -164,6 +202,7 @@ impl SharedState {
             admin_open_public: std::sync::atomic::AtomicBool::new(false),
             cmf,
             cache,
+            rate: RateWindows::default(),
             secrets,
             config_path,
             pipeline: crate::pipeline::Pipeline::new(),