feat(apicore-sync): authenticate with an ApiCore API key

APICORE_API_KEY replaces the service-account login: the key is sent as
the bearer token directly, needs no password and no MFA exemption, may
only read the shop feed and can be revoked in ApiCore at any time. A
malformed key is rejected with a clear message before any request.
Email/password stays as fallback for ApiCore versions without keys.

The system status treats the key or the legacy login as configured.
README, .env.example and the k8s secret template describe the key.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

.env.example

@@ -106,6 +106,12 @@ SMTP_FROM="Wabenhain <[email protected]>"
 #   harvests:read, products:read, extractions:read, bottling:read, apiaries:read
 # Details siehe src/lib/apicore-client.ts.
 APICORE_API_URL=
+# Empfohlen: API-Schluessel aus ApiCore → Verwaltung → Automatisierung →
+# API-Schluessel (Berechtigung "Shop-Daten lesen"). Kein Passwort, keine MFA,
+# jederzeit widerrufbar. Ist er gesetzt, werden die beiden Werte darunter
+# nicht gebraucht.
+APICORE_API_KEY=
+# Nur fuer aeltere ApiCore-Staende ohne API-Schluessel:
 APICORE_SYNC_EMAIL=
 APICORE_SYNC_PASSWORD=