refactor(llm-api): implement clean architecture following scraper pattern

Split monolithic 1012-line main.rs into layered hexagonal architecture:
- Domain: entity types and LlmError enum
- Application: prompt building, sampler construction, tool call parsing
- Infrastructure: LlamaEngine wrapping llama-cpp-2 with isolated unsafe transmute
- Presentation: Axum handlers, middleware (auth), error chain, router
- Config: type-safe AppConfig with LazyLock
- Bootstrap: Application struct with build() + run()

Resolves build_sampler/build_sampler_params duplication.
Adds simple web chat UI at GET /.

Co-Authored-By: Claude Code <noreply@anthropic.com>

src/presentation/middleware/auth.rs

@@ -0,0 +1,39 @@
+//! Authentication middleware.
+//!
+//! Checks for a valid Bearer token in the Authorization header.
+//! Only applied to routes that require authentication.
+
+use axum::extract::Request;
+use axum::http::StatusCode;
+use axum::middleware::Next;
+use axum::response::Response;
+
+use crate::config::CONFIG;
+
+/// Middleware that validates the Bearer token in the Authorization header.
+///
+/// If `API_KEY` is not set (empty), authentication is disabled and
+/// all requests pass through. If set, the middleware rejects requests
+/// without a matching token.
+pub async fn auth_middleware(request: Request, next: Next) -> Result<Response, (StatusCode, String)> {
+    let api_key = &CONFIG.api_key;
+    if api_key.is_empty() {
+        return Ok(next.run(request).await);
+    }
+
+    let header = request
+        .headers()
+        .get("authorization")
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or("");
+
+    let expected = format!("Bearer {api_key}");
+    if header == expected || header == api_key {
+        return Ok(next.run(request).await);
+    }
+
+    Err((
+        StatusCode::UNAUTHORIZED,
+        "{\"error\":\"unauthorized\",\"message\":\"Invalid API key\"}".into(),
+    ))
+}