fix: require auth for live update websocket token minting

[pinehill99]

Summary

• add a central auth service for protected API requests
• require workspace role and live_updates:token:mint scope before live-update websocket token minting
• cover bearer-token and ao_session browser clients while rejecting anonymous, stale, revoked, wrong-workspace, insufficient-role, insufficient-scope, and query-string-token clients

Fixes #3912

Validation

• python3 -m pytest tests/test_live_update_auth.py -q (9 passed)
• python3 -m pytest tests/test_live_update_auth.py tests/test_agent_registry.py tests/test_scheduler.py tests/test_config.py -q (27 passed)
• python3 -m py_compile src/api/auth.py src/api/middleware.py src/api/routes.py src/agent/__init__.py tests/test_live_update_auth.py
• uv run flake8 src/api/auth.py src/api/middleware.py src/api/routes.py src/agent/__init__.py tests/test_live_update_auth.py
• git diff --check

Full python3 -m pytest tests -q was attempted and stopped after hanging at the pre-existing tests/test_metrics.py::TestMetricsCollector::test_timer; full-suite pass is not claimed.