Add API auth

Add an API key or client credentials to protect an API. Then stop.

Guardrails

MUST read SCALEKIT_ENVIRONMENT_URL, SCALEKIT_CLIENT_ID, SCALEKIT_CLIENT_SECRET from env. MUST NOT hardcode them.
MUST validate the token server-side on every request. Return 401 on invalid, expired, or revoked.
MUST show plain-text token / plainSecret once. Store tokenId for list and invalidate. MUST NOT log or commit the secret.

Default language is Node. Default path is an org-scoped opaque API key.
Client credentials / M2M JWT is a different API. Open references/client-credentials.md. Do not call createToken on that path.
Python, Go, or Java → open references/languages.md.
Never SCALEKIT_ENV_URL. Do not prepend https:// if the env URL already has a scheme.
Copy the organization ID from the dashboard. Do not invent org_… values.
scalekit.token.validateToken is for opaque keys. scalekit.validateToken is for JWTs. Do not mix them.
Install @scalekit-sdk/node only when the repo has no Scalekit SDK yet.