#1847 [Feature]: Log authentication failures with the client source IP (for fail2ban / rate limiting)

Descripción

## What do you want to do?

**Please log authentication failures (HTTP 401) with the client's source IP address**, so that external tools such as fail2ban can detect and ban clients that keep trying wrong API keys against the server.

### Background / current behavior
The server protects `/v1/*` with an API key (`api_key` in the config, or `--api-key` / `STRATA_API_KEY`). When authentication fails, `_authorized()` in `serve/server.py` only replies with a 401 JSON body (type `authentication_error`, message `missing or wrong API key`) and returns. **No log line is written, and crucially no client IP is recorded.**

Because there is nothing to match on, a self-hosted deployment cannot use `fail2ban` (or any IP-based rate limiting) to defend against brute-force attempts on the API key, even though the server is typically exposed on the public internet (e.g. behind a router DNAT to port 8080).

### What already works elsewhere / the pattern that would help
`llama.cpp`'s server logs exactly this line on a bad key:

```
unauthorized: Invalid API Key from <ip>
```

and a fail2ban `filter` + `nftables` jail matches that line to ban the offender. Strata's 401 path currently produces no such log line at all.

### Suggested outcome (goal, not a specific implementation)
A single line to `stderr` on an authentication failure that includes the client IP (the code already has `self.client_address[0]` available in the handler). Format similar to llama.cpp would let the same fail2ban filter work unchanged for both servers.

### Environment
- Strata v0.1.41
- 2 × RTX 2080 Ti, 62 GiB RAM, Linux
- Server runs as a systemd service (non-root), logs land in the systemd journal
- API used via public endpoint through router DNAT to `127.0.0.1:8080`