Implemented the Api key Authentification Middleware

[KAMALDEEN333]

Implemented API Key Authentication Middleware for External Integrations

Description:
Created API key authentication middleware to support external integrations, webhooks, and third-party service access.

Requirements:
Support API key authentication via header (X-API-Key) or query parameter
Generate secure, cryptographically random API keys
Store API keys hashed in database (bcrypt or similar)
Associate API keys with specific users or services
Support multiple API keys per user/service
Define scope/permissions per API key (read-only, write, admin)
Track API key usage (rate limiting, analytics)
Support API key expiration dates
Allow API key revocation
Rotate API keys periodically
Log API key authentication attempts
Return 401 for invalid/expired/revoked keys
Acceptance Criteria:

External services can authenticate using API keys

API keys never stored in plain text

Each key has defined permissions scope

Invalid keys rejected with clear error message

API key usage tracked for billing/analytics (future)

Keys can be revoked instantly

Expiration dates enforced automatically

Key rotation supported without service interruption

Rate limiting applied per API key

Audit log of all API key usage
API Key Format:
Prefix: "mbk_" (Mind Block Key)
Environment indicator: "live_" or "test_"
Random string: 32 characters (base62)
Example: mbk_live_Ab3Cd5Ef7Gh9Ij1Kl3Mn5Op7Qr9St1U
Key Management:
Generation: Secure random generator
Storage: bcrypt hash with salt
Validation: Compare hashed values
Revocation: Mark as inactive in database
Expiration: Check expiry timestamp
Scopes/Permissions:
read: Can read data (GET requests)
write: Can create/update data (POST, PUT, PATCH)
delete: Can delete data (DELETE requests)
admin: Full access (all operations)
custom: Define specific endpoint access
Security Features:
Rate limiting per API key
IP whitelisting (optional)
Webhook signature verification
Key rotation reminders
Automatic expiration enforcement
Use Cases:
Third-party analytics tools
Webhook receivers
Mobile app authentication (alternative to JWT)
Partner integrations
Automated testing/CI/CD

closes #329

[drips-wave]

@KAMALDEEN333 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits