Arcads API key setup: credentials, security, and a first test

Generate the documented credential pair, keep authorization server-side, and verify access with a read-only request before enabling writes.