feat: Hermes prompt callback endpoint + API key management

- Add /api/prompt/<rid> callback endpoint with dual auth:
  per-request signed URL token + Bearer API key.
- Add HERMES_API_KEY config and runtime key helpers in app.py.
- Update admin request page to copy request details + callback URL.
- Add API key management to admin settings: regenerate, mask, show-once.
- Update .env.example, docker-compose.yml, README, REVIEW docs.

config.py

@@ -69,6 +69,10 @@ class Config:
     # Default customer revision limit if not overridden in runtime settings.
     MAX_REVISIONS = int(os.environ.get('MAX_REVISIONS', '2'))
 
+    # API key used by Hermes to POST generated Suno prompts back to the website.
+    # Also stored (encrypted) in runtime settings so it can be regenerated from /admin/settings.
+    HERMES_API_KEY = os.environ.get('HERMES_API_KEY', '')
+
     # Booth name used in customer-facing text and email sign-offs.
     BOOTH_NAME = os.environ.get('BOOTH_NAME', 'Trollgorithm Theme Songs')