fix(appsec): add auth enforcement and security regression tests to all routers

[izzywdev]

Summary

Rescues and lands uncommitted appsec work from the fix/appsec-authz branch. Addresses multiple findings from appsec audit #18.

• auth.py (MEDIUM-2): Remove insecure SECRET_KEY default. Fails closed (HTTP 503) on JWT ops when key is unset, blank, or a known-insecure placeholder. All jwt.encode/decode route through _require_secret_key().
• credentials.py (HIGH-2): Add per-tenant service-key identity scoping (require_identity_scope). A service key may only act for identities listed in <SERVICE>_ALLOWED_IDENTITY_IDS env. Unset/blank = deny all (fail closed). Resolves cross-tenant BOLA/enumeration on all four credential endpoints.
• google_integration.py (CRITICAL-1): All 5 routes were unauthenticated. Now gated by get_current_user (JWT) + ownership-scoped identity lookups. Closes unauthenticated PII exfiltration + account-creation vector. Migrated to async SQLAlchemy.
• llm_scraper.py (CRITICAL-2): Router-level Depends(get_current_user) gates every route (LLM POSTs, destructive DELETE).
• site_integrations.py (HIGH-1): /signup, /signin, /apikey now require auth — these drive credential-bearing browser automation.
• chat.py: Minor import fix (from sqlalchemy.future import select).
• test_security_regressions.py: New AREA 4 (per-tenant key scoping, 9 tests) and AREA 5 (route-level auth coverage introspection, 4 tests) regression suites. Fixture added to isolate AREA 3 IDOR tests from the new key-scope gate.

Test plan

• pytest backend/tests/test_security_regressions.py -v
• Unset SECRET_KEY; confirm token endpoints return 503
• Hit POST /api/google/signup/{id} without Bearer; confirm 401
• Hit POST /api/llm-scraper/generate without Bearer; confirm 401
• Hit POST /api/v1/integrations/signup without Bearer; confirm 401