feature: API-ключи клиентов и журнал использования в Postgres (#4, #17)

- Postgres в compose; пакет db (SQLAlchemy async): clients, windows, requests.
- Все эндпоинты, кроме /health, — только с ключом в X-API-Key, иначе 401; без
  выпущенных ключей доступа нет. В базе — только sha256 ключа.
- Задача и окно сессии привязаны к клиенту: чужой ключ их не видит.
- Воркер пишет журнал: окно (открыто, последнее обращение, закрыто) и задачу
  (в очереди, начало, конец, итог, данные без секретов). Сбой записи не роняет задачу.
- python -m db.cli create|list|revoke|stats; make key-create/key-list/key-revoke/stats.
- smoke и loadtest с ключом.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -9,10 +9,8 @@ behind Cloudflare-style JS challenges.
 Early MVP (v0), under active development. Single browser engine, no billing yet. Tasks and project wiki —
 [Redmine](https://redmine.sokolab.xyz/projects/robotex).
 
-Not implemented yet, though planned for v1:
-
-- API-key auth (`X-API-Key` is accepted but **not checked**) — [#4](https://redmine.sokolab.xyz/issues/4)
-- persisting request outcomes (success rate) — [#17](https://redmine.sokolab.xyz/issues/17)
+Every request needs a client API key in `X-API-Key` (keys are issued with `make key-create`). Usage — requests,
+their duration, browser time per client — is recorded in Postgres (`make stats`).
 
 ## Architecture
 
@@ -44,9 +42,12 @@ Client → Caddy (TLS) → api (FastAPI) ──task──▶ RabbitMQ ──▶
   the first request of a session; cookies passed in a request replace the profile's cookies.
 - **Browser identity is not configurable**: user agent and window size are the real browser's own — a spoofed UA
   mismatches `userAgentData` and Cloudflare blocks it. Clients take `user_agent` from the response.
+- **Clients and usage**: Postgres — API keys (sha256 only), a journal of browser windows (opened, last used,
+  closed) and of requests (queued, started, finished, outcome, task data without secrets). A task and a window are
+  visible only to the client that created them; no keys — no access.
 - **Logging**: stdout, level from `LOG_LEVEL`; client secrets (proxy credentials, 2captcha key, `fill` values,
   cookie values) are masked.
-- **Deployment**: Docker Compose — `api`, `worker`, `rabbitmq`, `redis`; TLS is terminated by Caddy on the host — see
+- **Deployment**: Docker Compose — `api`, `worker`, `rabbitmq`, `redis`, `postgres`; TLS is terminated by Caddy on the host — see
   [docs/Deployment.md](docs/Deployment.md).
 
 ### Project layout
@@ -54,6 +55,11 @@ Client → Caddy (TLS) → api (FastAPI) ──task──▶ RabbitMQ ──▶
 ```
 src/
   main.py              # api service: /v2/tasks, /v1/solve, /health, sessions
+  db/                  # Postgres, shared by api and worker
+    models.py          # clients, windows, requests
+    clients.py         # API keys: issue, check, revoke
+    journal.py         # worker: windows and requests journal
+    stats.py, cli.py   # usage report; python -m db.cli create|list|revoke|stats
   tasks/               # shared by api and worker, no browser
     store.py           # Redis: tasks, results, open windows, worker heartbeats
     broker.py          # dramatiq broker (RabbitMQ), queues, messages