[Feature / RFC] Implement Token Authentication for --multi-user mode to prevent unauthorized cross-user profile access

### Feature Idea

We propose adding an optional token-based authentication mechanism to `--multi-user` mode in `app/user_manager.py`.

### Problem Statement
Currently, in `--multi-user` mode:
1. `GET /users` unauthentically lists all registered user IDs.
2. `get_request_user_id(request)` identifies the active user purely from the client-supplied `comfy-user` HTTP header without verifying any secret token or signature.
3. Any client on the network can discover another user's ID from `/users` and pass `comfy-user: ` to read, overwrite, or delete their workflows under `/userdata/*`.

### Proposed Feature
1. When a user profile is created via `POST /users`, generate a secure random token (e.g. `secrets.token_urlsafe(32)`).
2. Require clients to send this token in the standard `Authorization: Bearer ` header.
3. Verify the token with `hmac.compare_digest()` before granting access to `/userdata/*`.
4. Keep single-user mode default behavior completely unchanged.

### Existing Solutions

Currently, users have to place ComfyUI behind an external reverse proxy (like Nginx / Authelia / OAuth2-Proxy). However, external reverse proxies only protect the entire server globally; they cannot enforce internal per-user directory isolation within ComfyUI's `/userdata` endpoints when multiple local profiles are used.

### Other

### Implementation Architecture & Readiness:
- We have tested this token verification logic locally and confirmed that it completely prevents header spoofing without introducing regressions to the frontend or workflow execution engine.
- If the maintainers are open to this enhancement, we would be very happy to prepare and submit a Pull Request!

Start in app/user_manager.py and trace POST /users, GET /users, get_request_user_id(request), and the /userdata/* endpoints. Review how multi-user and single-user modes currently differ. Done means per-profile bearer tokens are generated and verified without changing single-user behavior; no test path is named in the issue.

Written by the indexing model from the issue text.