refactor(auth)!: standardize Fanout headers

[vishr]

Summary

• require Authorization: Bearer <token> for both OTLP/gRPC and OTLP/HTTP
• rename X-Fanout-Request to Fanout-Request
• rename X-Fanout-Confirm-Delete to Fanout-Confirm-Delete
• update setup/settings metadata, benchmark traffic, README, operator docs, UI source, and embedded assets
• explicitly test that the retired ingest header is rejected on both transports

Breaking changes

There is no legacy fallback. Collectors using x-fanout-ingest-token must move the same token to Authorization: Bearer <token>. Browser/API consumers must use the renamed Fanout headers.

OTLP/HTTP remains on the standard /v1/traces, /v1/metrics, and /v1/logs paths. No custom Fanout contract-version header is introduced.

Validation

• just check
• go test -race -gcflags=all=-d=checkptr=0 -coverprofile=/private/tmp/fanout-standard-headers.coverage ./... — 914 tests across 24 packages
• focused Go tests — 384 tests across changed packages
• UI tests — 27 tests
• full binary and embedded-asset rebuild
• gitleaks on the complete diff — no findings