Optional gate to restrict Apollo to known clients (idea)

[elias-ba]

Description

This branch holds an optional access gate for Apollo. When turned on, every request to /services/* must carry a valid client token, and anything without one is rejected. It's the stricter sibling of the per-client key mapping in #536: that one only recognises tokens, this one requires them.

It builds on the same lightning_clients table and token hashing, and adds:

• token checking on every request, with a clear 401 when the token is missing or invalid;
• a safe default: if the gate is switched on but the client table can't be reached, it rejects requests rather than silently letting everyone in;
• a shared secret for Apollo's own internal calls between services, so they keep working and aren't mistaken for outside traffic.

Why it's parked

• It isn't needed for what we're doing now, Per-client API key mapping #536 covers that.
• It can't be used yet anyway: a client would have to be changed to send a token on its requests, and nothing sends one today. So it's a larger change that reaches beyond this repo and is worth discussing on its own.

Parked here so the work isn't lost. We can pick it back up if we ever want an Apollo that only known clients can call.

Related: #536.