feat: validate API keys against Asobi SaaS control plane

[Taure]

Summary

• New `asobi_saas_key_plugin` (Nova pre_request) that reads the `x-asobi-key` header, validates against saas `/internal/validate`, and stashes the resolved tenant/game/environment context on the request.
• 5-minute ETS cache keyed on the raw key; short-circuits the HTTP roundtrip on hot paths.
• Deployment-level environment enforcement: when `asobi.environment_name` is set (e.g. "dev" or "live"), responses whose `env_name` doesn't match are rejected with 403. So two engine deployments pointing at the same saas (api-dev.asobi.dev / api.asobi.dev) each only accept keys scoped to their own env.
• Passthrough when `saas_internal_url` is unset — local dev and existing CT suites keep working without a running saas.
• Prod config threads `ASOBI_SAAS_URL`, `ASOBI_SAAS_INTERNAL_TOKEN`, `ASOBI_ENVIRONMENT_NAME` through `prod_sys.config.src`.

Test plan

• `asobi_saas_key_plugin_SUITE` — 8 cases covering passthrough, path skip, missing/invalid/mismatched/valid/cached/unreachable. Driven through a mini cowboy mock saas so real httpc + URL encoding paths are exercised.
• rebar3 ct (164/164)
• rebar3 xref
• rebar3 fmt --check
• rebar3 dialyzer
• elp eqwalize-all — no new errors introduced (116 pre-existing to tackle separately)