feat: Add wardgate-proxy with key/key_env config aligned to wardgate-cli

[emretinaztepe]

Replace token_file-based config with key/key_env fields matching wardgate-cli conventions. The agent key lives in the config file itself -- no separate token file needed.

Key changes:

• Config struct uses key/key_env instead of token_file
• KeyReader interface with two implementations:
  • configKeyReader: watches config file mtime, re-reads on change, falls back to cached key on parse errors (atomic rotation safety)
  • staticKeyReader: for key_env mode, fixed for process lifetime
• Drop checkTokenFilePermissions (wardgate-cli doesn't check either)
• Add wardgate-proxy AI skill file for teaching agents
• Documentation and INSTALL.md updated

What

Why

Checklist

• Tests added/updated
• All tests pass (go test ./...)
• Code formatted (go fmt ./...)
• Docs updated (if applicable)
• I have the right to submit this contribution under the project license.
• I did not copy code/assets from incompatible or unknown-license sources.
• I have signed off all commits (git commit -s) per the DCO

DCO Sign-Off

All commits must include a Signed-off-by line (use git commit -s). This certifies that you wrote or have the right to submit the code under the project's AGPL-3.0 license. See the Developer Certificate of Origin for details.