refactor(auth): drop jwt exchange for api token

[zfarrell]

Deprecates the API-token → JWT key exchange: the configured api_key is now sent verbatim as Authorization: Bearer <token>, so hotdata/_auth.py (the _TokenManager minting from POST /v1/auth/jwt and refreshing via the refresh_token grant) is gone and Configuration.api_key is a plain attribute again.

The mustache template, .openapi-generator-ignore, and the regen workflow's safety gate are updated in the same change so a regeneration can't reintroduce the exchange. RefreshApi (POST /v1/refresh) is untouched — it is connection schema/data refresh, unrelated to refresh tokens.

[claude]

Verified the removal is complete and consistent: no remaining references to hotdata._auth, _TokenManager, TokenExchangeError, or HOTDATA_DISABLE_JWT_EXCHANGE outside the CHANGELOG/test narrative; .openapi-generator-ignore still lists the surviving hand-written modules; the template and generated configuration.py stay in sync and both are pinned by tests/test_api_token_auth.py.

Two things I checked specifically:

• test_jwt_opt_out_env_var_is_inert uses "0", which is the value the old code treated as non-affirmative — so it would have triggered a mint and tripped _no_network. It's a real regression pin, not a tautology.
• The inverted regen guard in .github/workflows/regenerate.yml scans the full source for the exchange needles and AST-checks that api_key is not a property and is assigned in __init__, which covers the reintroduction paths the old guard covered in the other direction.

CI checks were still queued/in progress when this review started, so I have not seen the unit or integration results.