feat: add external API runtime and request control plane

[bballdavis]

Summary

Adds phase two of #568 on top of foundation PR #750:

• opt-in external API control plane, disabled by default with EXTERNAL_API_ENABLED=false
• API-key authentication, permissions, channel grants, quotas, and safe logging
• catalog, thumbnail, request-lifecycle, work-limiter, and management route modules
• Swagger/contract fixtures and the external contract test server
• MariaDB 10.3 migration integration coverage for upgrade, rollback, idempotence, indexes, foreign keys, and normalized names

Review shape

This is a cumulative stacked draft targeting dev. It includes the phase-one foundation until #750 lands; after the prerequisite merges, rebase this branch so the review shows phase two only.

The external routes remain unreachable unless the explicit feature flag is set to true. The phase-two implementation also removes the speculative PRD from docs/, keeping shipped documentation separate from planning material.

Validation

• external/API-focused validation: 17 suites passed, 1 skipped; 173 tests passed, 1 skipped
• broader runtime/regression validation: 20 suites and 333 tests passed
• real MariaDB 10.3 migration matrix: 1 suite and 1 test passed
• backend ESLint and syntax checks passed with the isolated Windows checkout linebreak rule disabled
• the existing foundation PR feat: prepare external API persistence foundation #750 is green on its GitHub CI run

[dialmaster]

Holding off on a full review of this until #750 is merged, since it's stacked on that one and carries the same commits. Once 750 is merged, can you rebase this on dev so the diff is just phase two? #809 is stacked on this one in turn, so this needs to go in before that.

[bballdavis]

Holding off on a full review of this until #750 is merged, since it's stacked on that one and carries the same commits. Once 750 is merged, can you rebase this on dev so the diff is just phase two? #809 is stacked on this one in turn, so this needs to go in before that.

That was the plan! I just went ahead and started building out the PR's since i was confusing myself what was going where, but left them as draft. Once we get those first two I'll rebase and submit for review.