Feature Request: Add built-in authentication support

Summary

mirror-gui currently exposes all API endpoints (39 endpoints per API.md) without any authentication. In enterprise and disconnected environments, the GUI is typically exposed via a reverse proxy for
remote access, making unauthenticated endpoints a security concern.

Why This Is Needed

Disconnected OpenShift deployments are used in regulated environments (government, financial, healthcare) where every exposed service must enforce authentication. mirror-gui manages pull secrets,
registry credentials, and can trigger large-scale image downloads — operations that should not be accessible to anyone on the network. Without built-in auth, every deployment must add a reverse proxy
layer just for access control, which increases operational complexity and creates a gap between "service is running" and "service is secured."

Additionally, automation platforms like AAP (Ansible Automation Platform) need to authenticate to mirror-gui's REST API programmatically. Relying on network-level controls (firewall rules, reverse proxy
auth) is fragile and doesn't provide audit trails for who triggered which mirror operation.

Current Workaround

We use HAProxy with HTTP Basic Auth as a reverse proxy in front of mirror-gui:

userlist mirror_gui_users
    user admin insecure-password <password>

backend mirror_gui
    acl auth_ok http_auth(mirror_gui_users)
    http-request auth realm "Mirror-GUI" unless auth_ok
    server mirror-gui 127.0.0.1:3000 check

This works but has limitations:
- Adds infrastructure dependency (HAProxy or nginx required)
- No per-user access control or audit trail
- API consumers (e.g., AAP job templates) must handle proxy auth separately
- Cannot distinguish read-only vs read-write access

Proposed Feature

Built-in authentication support with at minimum:
- HTTP Basic Auth (simplest, works with all clients including curl and Ansible uri module)
- Token-based auth (for API consumers like AAP)
- Configurable via environment variables (e.g., AUTH_USERNAME, AUTH_PASSWORD, AUTH_ENABLED=true)

Nice to have:
- RBAC (viewer vs operator roles)
- OIDC integration for SSO environments
- API key support for automation

Use Case

We orchestrate mirror-gui via AAP 2.6 (Ansible Automation Platform) using an API bridge playbook that calls mirror-gui REST endpoints. AAP job templates need a clean way to authenticate to mirror-gui
without relying on network-level controls.

Architecture:
AAP Controller → Job Template → Ansible uri module → mirror-gui API
                                                      ↑
                                            needs auth here

Environment

- mirror-gui image: registry.ci.openshift.org/ocp/5.0:mirror-gui
- oc-mirror version: 4.22.0
- Deployment: Podman container on RHEL/CentOS Stream 10
- Proxy: HAProxy 2.x (current workaround)

Start with API.md and inventory the 39 exposed endpoints and their current entry points. Clarify the minimum authentication mechanism, configuration requirements, and API-consumer behavior before implementation. Done means the agreed authentication scope protects the intended endpoints and is usable by AAP automation.