feat(jawsidian): API key auth for remote Notes access

[lidge-jun]

Parent: #159

Scope

Add API key authentication primitives needed for safe non-localhost Notes access.

Planning source

• devlog/_plan/260503_jawsidian/phase-12_api_key_auth/plan.md

Acceptance notes

• Follow the numbered Jawsidian phase plan.
• Keep Manager Notes usable at the end of the phase.
• Add targeted unit/browser coverage for changed behavior.
• Keep web app first; Electron-only enhancements must be isolated behind capability gates.

[lidge-jun]

📌 Tracked in devlog/_plan/260503_jawsidian/phase-12_api_key_auth/. Umbrella moved back from _fin/ to _plan/ on 2026-05-16 — phases 05–17 are still plan-only artifacts.