afe99f2b64
Integrates #856 as a focused runtime API security slice. Default local behavior remains unchanged. `/v1/*` routes require a token only when `--auth-token` or `DEEPSEEK_RUNTIME_TOKEN` is set, and `/health` remains public for readiness checks. Co-authored-by: Zhuoran Deng <dengzhuoran9@gmail.com>