Replace the API-key header scheme with a real authentication flow

[phertyameen]

Description
The frontend sends a public API key as a custom header on every request. The backend's protected endpoints (account creation, account lookup, webhook management) don't check for this header at all - they require a properly signed bearer token that gets independently verified. There is currently no mechanism anywhere in the frontend for obtaining or refreshing such a token, and no mechanism on the backend for turning an API key into one.

Why this matters
As it stands, every request to a protected backend endpoint would be rejected as unauthenticated, regardless of whether the URL and payload are otherwise correct. This is an architectural gap, not a typo - it needs a decision about how the frontend is meant to authenticate (e.g., an issued session token, a backend-for-frontend exchange step, or something else) before it can be implemented.

Acceptance criteria

• - A decision is documented on how the frontend obtains a valid credential for the protected endpoints.
• - The API-key header is removed from requests to endpoints that don't check for it, or the backend is updated to support it consistently - whichever direction is chosen, both sides agree.
• - The chosen authentication flow is implemented for all protected endpoints (account creation, account lookup/listing, webhook management).
• - Public, unauthenticated endpoints continue to work without unnecessarily sending credentials.
• Priority: High - without this, none of the authenticated flows can function at all.

[kiel997]

Hi! I'd like to work on this issue. I have experience with backend development using Node.js and NestJS, including implementing JWT-based authentication, protected API endpoints, and REST APIs. I'm comfortable designing authentication flows, aligning frontend and backend integration, and ensuring secure access to protected resources. I'll follow the project's conventions and submit a clean, well-documented PR. Please assign this issue to me.

[grantfox-oss]

🦊 GrantFox — @kiel997 has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #231)
2. Your PR will be reviewed by the bridgelet-org maintainers

Good luck! Track your progress on GrantFox.