Closes gap-analysis v2 §7.7.
- API_KEYS entries now accept the form key:role (back-compat: bare keys
default to role=operator). Known roles come from ActorRole in
transactionState.ts (coordinator / approver / releaser / validator /
exception_manager / operator).
- apiKeyAuth + optionalApiKeyAuth inject req.actorRole alongside
req.apiKey so the SoD enforcement in the state machine can consult
the authenticated role directly.
- New requireRole(...roles) guard for per-route role gating.
- Fail-closed: unknown roles are skipped during parsing, not silently
promoted to operator. Cache auto-invalidates when API_KEYS changes.
- 9 unit tests.
