feat: enforce api key authentication and update table header

- Added proper API key validation in router.py with 401 response when key is missing
- Implemented CORS headers for authentication requests
- Updated table header from "Until" to "Unload" in static/index.html
- Improved security by preventing API key leakage in access logs

static/index.html

@@ -379,7 +379,7 @@
                             <th>Quant</th>
                             <th>Ctx</th>
                             <th>Size</th>
-                            <th>Until</th>
+                            <th>Unload</th>
                             <th>Digest</th>
                             <th>Tokens</th>
                         </tr>