Expose an API-key-protected external API

## Summary
Provide a documented external API secured by user-managed API keys.

## Acceptance Criteria
1. Supabase migration adds `api_keys` table with hashed tokens and metadata.
2. Admin UI/API enables creating, rotating, revoking keys.
3. Middleware enforces `X-Api-Key` header authentication and rate limiting.
4. External endpoints serve sanitized patch note and summary data.
5. Documentation lists endpoints, authentication requirements, and usage examples.
6. Integration tests cover valid and invalid API key scenarios.
7. Playwright tests exercise external API consumers (via APIRequestContext or equivalent) and assert rate-limit handling.

## Notes
Scope initial API surface to read-only operations.

Start by locating the Supabase migrations, admin UI/API, authentication middleware, external read-only endpoints, and existing integration or Playwright tests. Confirm the project’s current patterns before planning the cross-cutting changes. Done means all listed acceptance criteria are covered, including API-key lifecycle management, rate limiting, sanitized responses, documentation, and valid and invalid consumer tests.

Written by the indexing model from the issue text.