fix(api): authenticate /product, bind user_id to principal, clamp doc_path

[Evenss]

Description

Fixes the four issues reported in #2202, staying within the scope of the issue's Suggested change.

1. /product is unauthenticated — the router now declares dependencies=[Depends(verify_api_key)], so every current and future endpoint under it requires a key.
2. Auth is off by default — AUTH_ENABLED now defaults to true. The two health endpoints parse the same variable independently, so their defaults were flipped too; a startup warning is logged when auth is on but MASTER_KEY_HASH is unset.
3. user_id is client-supplied (IDOR) — new resolve_authorized_user_id() binds a non-privileged principal to its own user ID (an API key's user_name is the Product API user ID it may act as). Applied to the 17 /product endpoints that accept a caller-supplied user ID; the remaining endpoints have no user ID to bind, so they are authenticated but not further restricted. Master key / internal-service / admin principals keep acting for any user. With auth disabled, the identity is now pinned to MOS_USER_ID instead of the client-supplied X-User-Name.
4. doc_path reads arbitrary files, and None == None internal bypass — _get_all_documents confines doc_path to MEMOS_DOC_ROOT (falling back to FILE_LOCAL_PATH), re-resolving each matched file so symlinks cannot escape; local library usage with neither variable set is unchanged. is_internal_request no longer trusts the source IP and requires both the secret and the header to be non-empty, compared with hmac.compare_digest.

api_analyzer.py is a passive adaptation — it calls the endpoint functions in-process and must now pass an explicit internal auth.

Related Issue (Required): Fixes #2202

Breaking changes

• Deployments that do not set AUTH_ENABLED will start rejecting unauthenticated requests. MASTER_KEY_HASH was added to both docker/.env.example files; note server_api.py does not mount admin_router, so the master key is the only bootstrap path on the base server.
• API keys with a non-null expires_at will now always fail to authenticate. lookup_api_key compares a datetime against time.time(), and the TypeError is swallowed into a return None. It is pre-existing and fails closed, so it is left for a separate fix, but default-on auth makes it reachable.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

How Has This Been Tested?

• Unit Test

9 regression cases, one per issue item. The fixtures in test_server_router.py and test_cube_endpoints.py now supply an admin key, since their pre-existing cases would otherwise all return 401.

$ poetry run pytest tests/api/test_auth.py tests/api/test_server_router.py tests/api/test_cube_endpoints.py -q
37 passed in 9.71s

$ poetry run pytest tests/mem_os/test_memos_core.py -q -k DocumentPathConfinement
3 passed, 24 deselected in 8.18s

$ make format
All checks passed!

test_mos_init_invalid_user and the four test_mcp_serve.py import errors fail identically at the base commit and are unrelated.

Checklist

• I have performed a self-review of my own code | 我已自行检查了自己的代码
• I have commented my code in hard-to-understand areas | 我已在难以理解的地方对代码进行了注释
• I have added tests that prove my fix is effective or that my feature works | 我已添加测试以证明我的修复有效或功能正常
• I have created related documentation issue/PR in MemOS-Docs (if applicable) | 我已在 MemOS-Docs 中创建了相关的文档 issue/PR（如果适用）
• I have linked the issue to this PR (if applicable) | 我已将 issue 链接到此 PR
• I have mentioned the person who will review this PR | 我已提及将审查此 PR 的人