Auth and permissions

[whisper67265]

Problem

No integration test verifies that API token authentication works correctly on protected endpoints and that unauthenticated requests are properly rejected.

Acceptance Criteria

• API token auth works on protected endpoints
• Unauthenticated requests rejected with 401/403
• Test runs as part of integration-auth.yml
• PR approved by at least 1 reviewer

References

• Related files: boost_weblate/endpoint/views.py, Weblate auth configuration