F1.38 Gateway API key #399

An API key, generated (with Copy) and saved in the admin web app's Settings › Gateway access, kept as a hash. An app sending it as a bearer token on the operator port is the gateway's operator: it may transmit and change settings. Passwords stay for browsers. Wrong keys are rate-limited and logged.

Spec: docs/features/F1.38-gateway-api-key.md (maintainer request, 2026-10-26).