Public REST API + webhook subscriptions

API keys (dfk_…) with named scopes, /api/v1/assets as the first public surface, signed outbound webhooks with HMAC-SHA256 + retry backoff. Configure both at /settings.