feat: add API Key authentication, Dockerfile, and docker-compose

- core/auth.py: API Key auth via header X-API-Key (env PDFTOOLKIT_API_KEY)
  - Modo dev: sem chave configurada → acesso livre
  - Modo produção: exige chave, retorna 401/403
- api.py: endpoints protegidos com Depends(_auth_required)
  - /health e / permanecem públicos
- Dockerfile: multi-stage (base → api → web)
- docker-compose.yml: api + web com healthcheck, volumes e rede
- .env.example: template de variáveis de ambiente
- README.md: seções de autenticação e Docker

Dockerfile

@@ -0,0 +1,39 @@
+# ── Estágio 1: base ─────────────────────────────────────────────────
+FROM python:3.12-slim AS base
+
+WORKDIR /app
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PIP_NO_CACHE_DIR=1
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libgl1-mesa-glx libglib2.0-0 \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# ── Estágio 2: API ──────────────────────────────────────────────────
+FROM base AS api
+
+COPY . .
+
+EXPOSE 8555
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD python -c "import http.client; conn=http.client.HTTPConnection('localhost:8555'); conn.request('GET','/health'); r=conn.getresponse(); exit(0 if r.status==200 else 1)"
+
+CMD ["uvicorn", "api:app", "--host", "0.0.0.0", "--port", "8555"]
+
+# ── Estágio 3: Streamlit Web ────────────────────────────────────────
+FROM base AS web
+
+COPY . .
+
+EXPOSE 8550
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD python -c "import http.client; conn=http.client.HTTPConnection('localhost:8550'); conn.request('GET','/'); r=conn.getresponse(); exit(0 if r.status==200 else 1)"
+
+CMD ["streamlit", "run", "app.py", "--server.port", "8550", "--server.address", "0.0.0.0", "--server.headless", "true"]