feat(grpc): API key authentication middleware

[EngineerProjects]

Summary

The gRPC server currently has no authentication — anyone who can reach
the port can call any RPC. Add an API key middleware so the server can
be safely exposed on a network.

Design

• API key passed in gRPC metadata: authorization: Bearer <key>
• Keys configured via env var NEXUS_API_KEYS (comma-separated) or a keys file
• Unary + streaming interceptors check the key before forwarding
• HealthCheck RPC is exempt (used by load balancers)
• Invalid key → codes.Unauthenticated with a clear message

Acceptance criteria

• internal/grpc/auth/interceptor.go — unary + streaming interceptors
• Keys loaded from NEXUS_API_KEYS env var or --api-keys-file flag
• HealthCheck skipped by auth interceptor
• Unit tests: valid key passes, missing key rejected, invalid key rejected
• docs/transports.md updated with auth setup instructions