feat: Implement API authentication with RBAC integration

Implements comprehensive API authentication for Cloud Safeguard web server:
- RBAC-based authentication middleware with permission checking
- Multiple authentication methods: X-User header, Authorization Bearer/ApiKey, environment variables
- Permission-based endpoint protection for all API routes
- Context-based user extraction for downstream handlers
- Graceful fallback when RBAC is not configured (for testing)
- Comprehensive test coverage for authentication scenarios

Files added:
- internal/web/auth.go - Authentication middleware and utilities
- internal/web/auth_test.go - Authentication test suite

Files modified:
- internal/web/server.go - Integrated authentication middleware into routes
- internal/web/api.go - Added auth info endpoint
- cmd/simctl/main.go - Updated serve command to pass RBAC manager
- internal/web/handlers_test.go - Updated tests for authentication
- internal/web/server_test.go - Updated tests for authentication

Features:
- Permission-based access control for all API endpoints
- Multiple authentication methods for flexibility
- Secure context key handling to avoid collisions
- Comprehensive error handling and status codes
- Integration with existing RBAC system

Phase 3 Progress: API Authentication ✅ Complete
Next: OpenAPI Specification, Security Agents