gRPC API exposed without authentication

## Description
- gRPC server binds to `0.0.0.0:3030` without any authentication
- All wallet and contract operations exposed

## Fix
- Add API key authentication middleware
- Allow configurable bind address (default to `127.0.0.1`)
- Document authentication setup