feat(security): enforce API key auth on protected routes

[Kuhai9801]

Summary

Closes #186.

Enforces the existing API-key middleware on protected stream and indexer-webhook routes while preserving HMAC verification for indexer events.

Changes

• Mount apiKeyAuthMiddleware before JSON parsing for /api/v1/*.
• Mount apiKeyAuthMiddleware before raw-body parsing on POST /webhooks/indexer.
• Keep GET /health and GET /api/openapi.json public.
• Extend tests for missing, invalid, revoked, hashed, authorization-header, and valid API keys.
• Document the protected route scope.
• Add the Drizzle migration for streams.deleted_at.

Validation

• git apply --check feature-wire-api-key-auth-v5.patch
• git diff --check
• python -m json.tool drizzle/meta/_journal.json

Checklist

• Code follows existing TypeScript/Express patterns.
• Tests cover API-key auth edge cases.
• Documentation updated.
• Database schema change includes a migration.