feat: AUTH_MODE configuration, anonymous suggestions, and seed script

[JohnRDOrazio]

Summary

Support configurable auth modes and anonymous contribution workflows.

Requirements

AUTH_MODE

• AUTH_MODE=required|optional|disabled in config + auth module
• ANONYMOUS_USER returned in disabled mode

Anonymous Suggestions

• HMAC-signed tokens with 24h TTL
• 5 endpoints: create, save, submit, discard, beacon
• Rate limiting: 5 sessions per IP per hour
• Honeypot validation for bot protection
• suggestion_sessions model extensions

Seed Script

• scripts/seed-project.py for importing OWL files with direct PostgreSQL indexing
• Supports URL/file import, upstream sync config, index-only rebuild

Index Fix

• Include skos:altLabel, skos:prefLabel as annotations in class detail

[damienriehl]

Acceptance-criteria update ahead of the replacement PR (supersedes #27). The hardened contracts the current synthesis carries, beyond the original list:

• exact required | optional | disabled mode validation (any other value is refused at startup);
• optional mode with all provider credentials absent is a supported configuration;
• partial provider credentials are refused rather than defaulted;
• anonymous suggestion authorization, per-IP rate limiting, honeypot handling, and session cleanup/reaper behavior;
• public-project reads without a token, while private and authenticated mutations stay closed;
• WebSocket auth honors auth_mode with HTTP parity.

The seed-script and annotation-index items from the original scope are not part of the replacement PR and remain tracked here.