Add simulation-gateway auth client to API v1

[anth-volk]

Fixes #3496

Summary

Add the missing API v1 caller-side auth for the simulation gateway.

This introduces an Auth0 client-credentials token provider, attaches bearer auth to outbound simulation-gateway requests, validates partial GATEWAY_AUTH_* configuration at startup, and passes the four required env vars through the deploy path so App Engine can mint tokens at runtime.

[codecov]

Codecov Report

❌ Patch coverage is 88.98305% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 77.00%. Comparing base (e62e93a) to head (01d5bc1).
⚠️ Report is 11 commits behind head on master.

Files with missing lines	Patch %	Lines
policyengine_api/libs/gateway_auth.py	87.73%	8 Missing and 5 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3497      +/-   ##
==========================================
- Coverage   77.97%   77.00%   -0.98%     
==========================================
  Files          62       63       +1     
  Lines        3301     3418     +117     
  Branches      596      617      +21     
==========================================
+ Hits         2574     2632      +58     
- Misses        562      612      +50     
- Partials      165      174       +9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.