feat: add API key authentication system and update documentation

API Key System:
- Add TpmjsApiKey, ApiUsageRecord, ApiUsageSummary models to schema
- Create API key utilities (generate, hash, mask with tpmjs_sk_ prefix)
- Implement dual auth middleware (session + API key)
- Add rate limiting with Vercel KV
- Create CRUD endpoints for API key management
- Add usage tracking and analytics endpoint
- Build API key management UI in dashboard
- Build usage dashboard with charts

Route Protection:
- Require auth for MCP endpoints (mcp:execute scope)
- Require auth for agent chat (agent:chat scope)
- Require auth for bridge connections (bridge:connect scope)

Documentation Updates:
- Update all curl/fetch examples with Authorization header
- Document API key format, scopes, and rate limits
- Update PRD-MCP-BRIDGE.md, MCP-AGGREGATOR-DESIGN.md
- Update API docs page with auth requirements
- Update HOW_TO_PUBLISH_A_TOOL.md

HOW_TO_PUBLISH_A_TOOL.md

@@ -217,7 +217,11 @@ Your tool will be automatically discovered through:
 
 After publishing, your tool should appear on https://tpmjs.com within 15 minutes!
 
-You can verify by searching: https://tpmjs.com/api/tools?q=yourpackagename
+You can verify by searching (requires API key):
+```bash
+curl "https://tpmjs.com/api/tools?q=yourpackagename" \
+  -H "Authorization: Bearer tpmjs_sk_your_api_key_here"
+```
 
 ## Real Example: @tpmjs/createblogpost
 
@@ -411,14 +415,15 @@ Or manually check the structure matches the examples above.
 - Add all Rich tier fields for maximum visibility
 
 **Want to force a sync?**
-You can manually trigger a sync (requires auth):
+You can manually trigger a sync (requires CRON_SECRET, not a user API key):
 ```bash
 curl -X POST "https://tpmjs.com/api/sync/keyword" \
-  -H "Authorization: Bearer YOUR_CRON_SECRET"
+  -H "Authorization: Bearer $CRON_SECRET"
 ```
 
 ## Support
 
 Questions or issues?
 - File an issue: https://github.com/ajaxdavis/tpmjs/issues
-- Check the API: https://tpmjs.com/api/tools
+- Check the API docs: https://tpmjs.com/docs/api
+- Generate an API key: https://tpmjs.com/dashboard/settings/tpmjs-api-keys