feat: add config-based request authentication

[davetha]

Summary

• add optional inbound request authentication for /v1/messages and /messages using configured API keys
• add JSON config loading from ~/.config/meridian/config.json, ./meridian.config.json, or CLAUDE_PROXY_CONFIG
• document local and Docker config patterns, including env-backed secrets and plaintext JSON keys

Use Case

I have both a personal and a company Claude account/plan, and I want to use Meridian from several systems over my local network or a private Tailscale tunnel instead of installing Meridian and repeating claude auth everywhere.

This PR is part of that shared-instance setup: it adds a better config story and a way to restrict which clients can call the proxy.

Dependency

Draft because this currently stacks on top of:

• feat: add profile-based routing foundation #161

GitHub cannot express the exact stacked base across forks, so this draft PR includes the earlier profile-routing commits until #161 merges.

Testing

• bun test src/__tests__/proxy-auth.test.ts src/__tests__/configLoader.test.ts src/__tests__/proxy-async-ops.test.ts
• npm run build

[davetha]

Superseded by #165