feat: support api key auth

[autumn-pku]

Summary

• Add runtime API key support via --api-key, VIKING_API_KEY, and stored api-key config.
• Use Bearer auth for data-plane/runtime calls while keeping OpenAPI/control-plane calls on AK/SK signing.
• Thread API key options through search, chat, data, and search tuning command paths, including optional --scene-id for tuning runtime entry selection.
• Add safeguards/tests so explicit AK/SK takes precedence for control-plane work and local output folders stay ignored.

Validation

• npm run build
• npx tsx scripts/http-header-config.test.ts
• git diff --check
• local search run API-key smoke against a mock data-plane server

Notes

• npm run test:acceptance:dist still has existing repository-level acceptance failures in skill-list/skill validation and fake-AK auth status checks; the search tuning and runtime command acceptance cases pass after updating the scene-id help assertion.