mosaic-compass: fork-specific changes for Porter deployment

[EdgarBabajanyan]

• Add Bearer-token auth middleware (COMPASS_API_KEY env var). All routes except /health require Authorization: Bearer . Constant-time comparison to avoid timing leaks. When the env var is unset the server starts in unauthenticated dev mode with a loud warning.
• Fix broken healthcheck on both Dockerfiles by installing curl in the runtime stage (docker-compose.yml healthcheck command relies on it).
• Add scripts/download-models.sh: idempotent pre-deploy job that fetches BGE-small from HuggingFace into the persistent volume. Uses plain curl so no Python is needed at runtime.
• Add porter.yaml: web service on port 4001, predeploy hook for model download, default env (DATA_DIR, telemetry off).
• Add MOSAIC.md documenting the fork's divergence from upstream.

Description

Briefly describe the changes in this PR.

Related issue

Fixes #(issue number) or closes #(issue number)

Type of change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Breaking change
• Documentation update
• Performance improvement

Testing

How have you tested these changes? Include steps to reproduce.

Checklist

• cargo fmt --all is clean
• cargo clippy --workspace -- -D warnings passes
• cargo test --workspace passes
• CHANGELOG.md updated under [Unreleased] section
• Public API changes have rustdoc comments
• Behavior changes have a regression test

Before/after (if applicable)

Performance benchmarks, screenshots, or other evidence of the change:

(paste before/after data here)