Add API auth

Add an API key or client credentials to protect an API. Then stop.

Guardrails

• MUST read SCALEKIT_ENVIRONMENT_URL, SCALEKIT_CLIENT_ID, SCALEKIT_CLIENT_SECRET from env. MUST NOT hardcode them.
• MUST validate the token server-side on every request. Return 401 on invalid, expired, or revoked.
• MUST show plain-text token / plainSecret once from the create path. Store tokenId for list and invalidate. MUST NOT log or commit the secret.
• MUST write create, validate, list, and invalidate even when env is missing. Ask for the three env names and the dashboard organization ID. Do not invent those values. Do not wait for a live create.

Gotchas