#2712 log unauthorized API-key attempts with the client IP (issue #1847)

说明

## What this does

Adds a log line on API-key authentication failure that includes the client source IP, so fail2ban (or any log-based rate limiter) can match it and ban brute-force attempts. Closes #1847.

Before this change, `_authorized()` in `serve/server.py` replied with a silent 401 JSON body — nothing landed in the journal, so there was nothing for a filter to match on.

```python
print(f"unauthorized: Invalid API Key from {self.client_address[0]}", file=sys.stderr, flush=True)
```

The wording deliberately mirrors llama.cpp's `unauthorized: Invalid API Key from <ip>` verbatim (as requested in #1847), so an existing fail2ban filter written for llama.cpp works against Strata's logs unchanged.

Notes:
- Goes to `stderr`, consistent with other warnings in this file (e.g. the AMD line at L2845); `flush=True` keeps journald real-time so fail2ban doesn't miss events.
- No `[strata]` prefix on purpose, to keep the line byte-compatible with the stock llama.cpp filter regex.
- `sys` is already imported at module level; no new dependencies.

## Verification

- `python3 -m py_compile serve/server.py` passes.
- Smoke-tested the patched failure branch in isolation: emits exactly `unauthorized: Invalid API Key from 203.0.113.7` on stderr.
- Not end-to-end tested against a running server (needs GPU/model engine); the change is one print statement on the existing 401 path.