Require authentication for remote server binding

[Thump604]

What changed

• Require an API key when binding to a non-loopback address.
• Authenticate GET and POST endpoints with a constant-time bearer-token comparison.
• Support --api-key and MLX_LM_API_KEY.

Root cause

Explicit remote binding exposed dynamic model, draft, and adapter selection without authentication while wildcard CORS was enabled by default.

Validation

• Regressions verify unauthenticated requests return 401 and remote binding without a key is rejected.

Fixes #1695