Optional API key and request size limits

[delcenjo]

For internal but networked use, an optional API key header and a max instances-per-request limit would add a basic guardrail without pulling in a full auth stack. Both off by default to keep the one-command path simple.