feat(push-api): implement push API with authentication and validation logic

[klesh]

Summary

• I have read through the Contributing Documentation.
• I have added relevant tests.
• I have added relevant documentation.
• I will add labels to the PR, such as pr-type/bug-fix, pr-type/feature-development, etc.

Summary

• default-denies the push API unless PUSH_API_ALLOWED_TABLES is explicitly configured
• blocks writes to internal _devlake_* tables even if they are mistakenly added to the allowlist
• requires a Bearer API key on /push/* regardless of AUTH_ENABLED, and adds focused middleware and validation tests

Does this close any open issues?

Closes N/A

Screenshots

N/A

Other Information

• updated env.example and backend/server/api/push/README.md to reflect the secure push API defaults
• added coverage in backend/server/api/middlewares_test.go and backend/server/services/pushapiaccess/access_test.go

[Startrekzky]

LGTM