feat(api): API keys + Redis rate limiting + usage stats

Add an optional API-key layer to the public read-only API. Keys grant
higher per-minute rate limits and attribute usage; anonymous callers are
still allowed at a lower IP-based budget.

- migration 0008_api_key: api_key table (sha256 hash only, plaintext shown once)
- apikey pkg: key generation + hashing
- ratelimit pkg: Redis fixed-window limiter + per-key usage counters; fails open
- public API middleware: X-API-Key / Bearer auth, X-RateLimit-* headers, 429+Retry-After
- admin: issue/list/revoke keys + usage view (API + UI tab)

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

api/cmd/admin/main.go

@@ -17,6 +17,7 @@ import (
 	"github.com/baicai2026-baicai/goods/api/internal/adminstore"
 	"github.com/baicai2026-baicai/goods/api/internal/adminweb"
 	"github.com/baicai2026-baicai/goods/api/internal/auth"
+	"github.com/baicai2026-baicai/goods/api/internal/ratelimit"
 )
 
 func getenv(key, fallback string) string {
@@ -69,7 +70,9 @@ func main() {
 	}
 
 	authn := auth.New(username, passwordHash, secret, 12*time.Hour)
-	h := adminhandler.New(adminstore.New(pool), authn, basePath, adminweb.Dist())
+	usage := ratelimit.New(getenv("OPENGOODS_REDIS_URL", "redis://localhost:6379/0"))
+	h := adminhandler.New(adminstore.New(pool), authn, basePath, adminweb.Dist()).
+		WithUsage(usage)
 
 	srv := &http.Server{
 		Addr:              addr,