Ed25519 secret key accepted over unauthenticated HTTP API

[consigcody94]

Found via code audit. crates/ain-node/src/api.rs:83-96. /v1/publish accepts secret_key_b64 in JSON body over plain HTTP with zero auth. Any network client can impersonate any agent.