Add opt-in model update endpoint + API key support

Gateway: POST /admin/update-model downloads new GGUF and reloads.
Disabled by default — requires ALLOW_MODEL_UPDATES=true in .env.
Matt controls whether remote model updates are allowed.

Self-play: --api-key flag for authenticated gateway connections.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.env.example

@@ -4,3 +4,4 @@ GPU_TDP_WATTS=54
 SYSTEM_OVERHEAD_WATTS=30
 ELECTRICITY_RATE=0.15
 SPENDING_CAP=10.00
+ALLOW_MODEL_UPDATES=false