docs(readme): fix quickstart demo API key to match server hashing

[marevol]

Summary

The quickstart in README.md shipped a demo X-API-Key that the server rejects unconditionally, so following the quickstart end-to-end always failed with {"detail":"Invalid API key","code":"invalid_api_key"}. This patches the demo plaintext and hash so the example works as written.

Changes Made

• README.md: replace RECOTEM_API_PLAINTEXT="recotem-quickstart" (18 chars) with recotem-quickstart-demo-key-0000 (32 chars), meeting _API_KEY_MIN_LEN = 32 enforced in src/recotem/serving/auth.py.
• README.md: replace the RECOTEM_API_KEYS digest with the correct scrypt(N=2, r=8, p=1, dklen=32, salt=b"recotem.api-key.v1") hex of the new plaintext (21be5c3b…f125). The previous value was a plain sha256() of the old plaintext, which never matches what recotem.serving.auth._hash_api_key computes — the sha256: token on the wire is a digest-family label, not the algorithm name.

Testing

• Re-derived the digest via recotem.serving.auth._hash_api_key("recotem-quickstart-demo-key-0000") and confirmed it equals the new README value byte-for-byte.
• Length check: len("recotem-quickstart-demo-key-0000") == 32, so the _API_KEY_MIN_LEN guard no longer rejects it.

Breaking Changes

None — README-only documentation fix. Operators following the quickstart will set new env values, but no code, schema, or wire format changed.

Additional Notes

• This regression was introduced by docs(readme): use demo keys in quickstart to remove keygen step #95 (docs(readme): use demo keys in quickstart to remove keygen step), which precomputed the hash with the wrong algorithm and a too-short plaintext.
• The new demo plaintext is still obviously a demo (…-demo-key-0000); the existing "DEMO ONLY — for production, generate fresh keys" warning above it is unchanged.