feat(cognigate): port reference/agents/auth_keys routers from external repo

[vorionsys]

Summary

Track 2 PR1 of the cognigate cherry-pick plan. Ports the three lowest-risk, zero-dependency routers from the external standalone cognigate repo into `cognigate-api/`, restoring 3 of the 4 missing resource categories that `packages/n8n-nodes-cognigate` expects.

The problem

Cognigate was partially migrated from `c:/voriongit/cognigate/` into the monorepo as `cognigate-api/`. The external repo had 9 routers that never made it across. The monorepo's `cognigate-api` only registered 6 routers (health, intent, enforce, proof, admin, integrity) while the n8n community node (packages/n8n-nodes-cognigate) dispatches to 8 resource categories. Result: point the n8n node at the monorepo and ~50% of operations 404.

What this PR ships

Three routers with near-zero transitive dependencies:

• reference — read-only lookups: tiers, capabilities, error codes, rate limits, versions, products, domains
• agents — CRUD for agent registration with observation-tier-based initial scores and ceilings
• auth_keys — API key CRUD behind `X-API-Key` with IA-5(1) strength validation

Files added

File	LOC	Purpose
`app/constants_bridge.py`	1268	Shared constants (TIER_THRESHOLDS, CAPABILITIES, RATE_LIMITS, etc). Pure stdlib leaf, no transitive deps.
`app/routers/reference.py`	303	12 GET endpoints
`app/routers/agents.py`	217	POST/GET/PATCH/DELETE `/v1/agents`
`app/routers/auth_keys.py`	122	POST/GET/DELETE `/v1/auth/keys`
`tests/test_reference.py`	19 tests	Smoke + filter + 404 paths
`tests/test_agents.py`	14 tests	All 5 observation tiers, conflict, tier filter, update, revoke
`tests/test_auth_keys.py`	13 tests	Auth enforcement, create/list/delete, hash-not-raw, strength validation

Files modified

• app/core/auth.py — add `verify_api_key` (X-API-Key Security dependency) and `validate_api_key_strength` (IA-5(1): length ≥ 32, known-weak rejection, weak-pattern detection, character-class diversity). Upgrade `generate_api_key` to re-validate with `max_attempts` defense-in-depth.
• app/config.py — add `api_key: str` setting for pipeline endpoints
• app/main.py — import + register the 3 new routers with `api_prefix`

Test result

```
cd cognigate-api && pytest
============================= 191 passed in 2.37s =============================
```
+46 new tests over the previous 145. All existing tests still green. Black + ruff clean on changed files.

Deep Space exclusion (load-bearing)

Did not port `verify_deepspace_key`, `tmr_consensus`, `monte_carlo`, `self_healing`, or `deepspace.py`. Per external commit `46613a3 feat(security): isolate deep space proprietary algorithms with separate authentication`, these are intentionally excluded from the OSS monorepo. Their absence prevents accidental wiring.

What's next in the cherry-pick sequence

• PR2: alembic bootstrap against existing schema + CI drift check (prerequisite for PR3)
• PR3: `trust` router + `trust_decay.py` + `TrustStateDB`/`TrustSignalDB` + migration 0002
• PR4: `compliance` router + `control_health.py` (after signatures/velocity API drift check)
• PR5: `gateway` router + `upstream_client.py` (cognigate.dev unified developer entry point)

After PR5 lands, the n8n node should exercise all 8 resources successfully against the monorepo. Full plan in `C:\Users\racas.claude\plans\radiant-honking-puddle.md`.

Test plan

• cognigate-api pytest → 191 passed (145 existing + 46 new)
• Start cognigate-api locally, hit `GET /v1/reference/tiers` → 200 with 8 tiers
• Hit `POST /v1/agents` with `{"name": "test"}` → 201 with GRAY_BOX defaults
• Hit `POST /v1/auth/keys` without `X-API-Key` → 401
• With valid `X-API-Key` → 201 and raw key returned once
• n8n-nodes-cognigate `reference`, `agent`, and `auth_keys` operations succeed against local cognigate-api