feat(security): API key auth, HMAC webhook verification, rate limiting, Zod validation

04b12d1