Update config and dependencies for auth

Refactor configuration loading to separate user credentials from server
settings.
Update dependencies to their latest compatible versions to leverage new
features
and security patches.

Key changes include:
- Moving user credentials (`api_key`, `web_password`, `role`) from
  `.env`
  to a dedicated `users.toml` file for better manageability and
  security.
- Introducing an `AuthenticatedUser` struct and extractor for API
  key-based
  authentication.
- Updating `axum` and related crates to leverage Rust edition 2024
  improvements.
- Adjusting configuration values and tests to reflect these changes.

server/tests/auth_test.rs

@@ -0,0 +1,99 @@
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use axum::body::Body;
+use axum::http::{Request, StatusCode};
+use tower::util::ServiceExt;
+
+use doctate_server::config::{Config, User};
+
+fn test_config() -> Arc<Config> {
+    Arc::new(Config {
+        server_port: 3000,
+        data_path: "/tmp/doctate-test".into(),
+        log_level: "info".into(),
+        log_path: "/tmp/doctate-test/logs".into(),
+        log_max_days: 90,
+        users: vec![User {
+            slug: "dr_test".into(),
+            api_key: "test-key-123".into(),
+            web_password: "unused".into(),
+            role: "doctor".into(),
+        }],
+        api_keys: HashMap::from([("test-key-123".into(), "dr_test".into())]),
+        retention_audio_days: 30,
+        retention_transcript_days: 30,
+        retention_document_days: 0,
+        whisper_url: "http://localhost:10300".into(),
+        whisper_timeout_seconds: 120,
+        ollama_url: "http://localhost:11434".into(),
+        ollama_model: "gemma3:4b".into(),
+        ollama_keep_alive: 0,
+        llm_url: String::new(),
+        llm_api_key: String::new(),
+        llm_model: String::new(),
+        llm_temperature: 0.0,
+        session_timeout_hours: 8,
+    })
+}
+
+#[tokio::test]
+async fn valid_api_key_returns_user() {
+    let app = doctate_server::create_router(test_config());
+
+    let response = app
+        .oneshot(
+            Request::builder()
+                .uri("/api/debug/whoami")
+                .header("X-API-Key", "test-key-123")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+
+    assert_eq!(response.status(), StatusCode::OK);
+
+    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+
+    assert_eq!(json["slug"], "dr_test");
+    assert_eq!(json["role"], "doctor");
+}
+
+#[tokio::test]
+async fn invalid_api_key_returns_401() {
+    let app = doctate_server::create_router(test_config());
+
+    let response = app
+        .oneshot(
+            Request::builder()
+                .uri("/api/debug/whoami")
+                .header("X-API-Key", "wrong-key")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+
+    assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn missing_api_key_returns_401() {
+    let app = doctate_server::create_router(test_config());
+
+    let response = app
+        .oneshot(
+            Request::builder()
+                .uri("/api/debug/whoami")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+
+    assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+}