Add api stack with freepik and facefusion behind forwardAuth

Traefik routes api.pivoine.art/freepik and /facefusion to their
respective containers with path rewriting, shared API token auth
via an nginx sidecar, and api-rate-limit middleware.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/auth.conf.template

@@ -0,0 +1,9 @@
+server {
+    listen 8080;
+    location / {
+        if ($http_x_api_key != '${API_TOKEN}') {
+            return 401;
+        }
+        return 200;
+    }
+}