Fix production-readiness issues: merge conflicts, auth, logger, hardcoded credentials

[Copilot]

The repo had unresolved merge conflict markers in README.md, no API authentication, console.* scattered through server code, and hardcoded postgres password in docker-compose.yml.

Changes

README.md

• Resolved two <<<<<<< HEAD/>>>>>>> conflict blocks (models directory listing + env vars table)
• Removed "coming soon" from Docker section; marked Docker Compose roadmap items complete

Authentication (api/server.ts)

• Optional API key middleware: when API_KEY env var is set, all /api/* routes require X-API-Key header; /api/health stays public
• Uses crypto.timingSafeEqual to prevent timing-attack side-channels
• No-op when API_KEY is unset — fully backward-compatible

Structured logger (logger.ts)

• Lightweight logger with ISO timestamps + log levels, gated by LOG_LEVEL env var
• Replaced all console.log/warn/error calls in server.ts and routes.ts

Credentials

• docker-compose.yml: POSTGRES_PASSWORD: postgres → ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set} — Docker Compose now refuses to start without an explicit value
• .env.example: password placeholder changed to YOUR_STRONG_PASSWORD_HERE; added API_KEY, OpenRouter block, corrected embeddings defaults

Misc

• Root package.json: added missing author field
• sandeep-ai/package.json: added build:start script (npm run build && npm start) for production/CI use