feat(v3): add CRM gateway /v1/chat/completions with key auth + governance check

- POST /v1/chat/completions public route on CRM (not host pass-through)
- Bearer token → sha256 fingerprint → ListByFingerprint → governance check
- paused → 403 forbidden, retired/deleted → 403
- ProxyRouteChatCompletions to upstream
- NewAPIHandler/NewAPIHandlerWithAuth: optional dsn param for gateway SQLite access
- ListByFingerprint in user_keys_repo

internal/app/batch_utils_test.go

@@ -51,7 +51,7 @@ func TestFirstNonEmptyString_First(t *testing.T) {
 }
 
 func TestFirstNonEmptyString_AllEmpty(t *testing.T) {
-	if firstNonEmptyString("", "", "") != "" {
+	if firstNonEmptyString("", "") != "" {
 		t.Error("all empty should return empty")
 	}
 }