fix: MCP endpoint at /api/mcp (Bug #2) + REST API key auth (Bug #3)

Bug #2 (LOW): MCP endpoint was mounted at /mcp instead of /api/mcp,
inconsistent with all other API routes. Changed app.route("/mcp", ...)
to app.route("/api/mcp", ...) in apps/api/src/index.ts.

Bug #3 (MEDIUM): REST API endpoints only accepted JWT cookie/session
auth, not API key auth. Added authenticateApiKey() to authMiddleware
in apps/api/src/middleware/auth.ts so REST endpoints now accept
Authorization: Bearer <api_key> as a fallback after JWT verification.

docker-compose.yml

@@ -31,6 +31,8 @@ services:
       - PORT=3000
       - DATABASE_URL=postgresql://project_e:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}@db:5432/project_e
       - AUTH_SECRET=${AUTH_SECRET:-stub-secret}
+      - INITIAL_ADMIN_EMAIL=${INITIAL_ADMIN_EMAIL}
+      - INITIAL_ADMIN_PASSWORD=${INITIAL_ADMIN_PASSWORD}
     networks:
       - project-e-network
     depends_on: