QP: add first-class inbound auth

[bjagg]

Part of the ADR-0003 epic #1105. Plan: docs/operations/proposals/advisor-qp-direct-retrieval.md (PR #1104). Decision: ADR-0003.

Goal: Give the QP first-class inbound auth — it is unauthenticated today, and direct consumption removes GraphQL's X-API-Key gate.

Scope:

• Add ApiKeyAuthMiddleware (as GraphQL/mdr-api, bases/lif/api_graphql/core.py:59) or the composite cognito_auth brick to query_planner_restapi.
• Issue an internal QP key held by semantic-search (mirrors LIF_GRAPHQL_API_KEY).
• Validate the orchestrator's already-sent bearer token (lif_job.py:249-250).

Size: M · Depends on: —

[bjagg]

Scope correction from the PR #1104 review: enabling QP auth is a breaking change for the existing GraphQL→QP path, not just an addition — the GraphQL resolver POSTs to the QP with no auth today (type_factory.py:814), so it will 401 once auth is enforced. This issue must also update the GraphQL resolver's QP client to send the key and roll out accept-then-enforce. Recommended mechanism: a service API key (the QP is internal-only), not full Cognito. Re-sized M → L.