feat: API Key and person UUID based meetecho APIs

[rjsparks]

Adds a parallel set of DRF endpoints for the session data Meetecho pushes, keyed by
Person UUID and authenticated by service token. The six existing personal-API-key
endpoints keep working, so Meetecho migrates on its own schedule with no coordinated
cutover.

New endpoints

Endpoint	Body
POST /api/meeting/session/{id}/video-url/	{"url": ...}
POST /api/meeting/session/{id}/recording-name/	{"name": ...}
POST /api/meeting/session/{id}/bluesheet/	{"bluesheet": [{"name", "affiliation"}]}
POST /api/meeting/session/{id}/attendees/	{"attendees": [{"person_uuid", "join_time"}]}
POST /api/meeting/session/{id}/chatlog/	{"chatlog": [...]}
POST /api/meeting/session/{id}/polls/	{"polls": [...]}
GET /api/meeting/registration/attended/by-uuid/{uuid}/	—

JSON in, JSON out, X-Api-Key via api_key_endpoint. Errors use the project's
standardized error envelope.

Decisions

• Identifiers. Only the attendees endpoint carried a person identifier
  (user_id, a User pk — the OIDC sub); it becomes person_uuid. Any UUID the
  datatracker issued resolves, including one superseded by a merge. Meetecho already
  gets these from the datatracker_uuid OIDC claim. Sessions stay addressed by pk.
• Free text stays free text. Bluesheet names and chatlog authors are what the
  uploader observed, not person references — Meetecho can't always resolve a room
  attendee or chat participant to a Person.
• Authorship. A token identifies an application, so request.user is
  AnonymousUser and document events are authored by the (System) Person. This also
  drops the Recording Manager role check: authorization is possession of the token.
• All-or-nothing attendees. Matching the existing api, one unresolvable UUID rejects the
  request; the rows and an interim meeting's bluesheet are written in one transaction. A version
  that allows partial success is left as a future exercise.

Deploying

Needs seven APP_API_TOKENS keys: ietf.api.meeting.session.{video_url, recording_name,bluesheet,attendees,chatlog,polls} and
ietf.api.meeting.registration.attended_by_uuid. Separate keys so any one capability
can be withdrawn independently; the same token value can serve all seven.

Changes to existing behavior

Commits 1–3 touch code the existing endpoints share. Five of the six are
behavior-identical. The exceptions, both on a session with no official timeslot:

• api_set_session_video_url and api_upload_bluesheet already answered 400 for that
  input, because require_api_key catches AttributeError. Only the message changes.
• upload_session_bluesheets and finalize have no such catch, so they change from a
  500 to a form error and a user message.

Notes

Reviewed adversarially before merge; the findings are folded into the commits they
belong to. Known and deliberately not fixed here: the legacy recording-name endpoint
still does no length validation against its 64-character column.

[codecov]

Codecov Report

❌ Patch coverage is 98.37838% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.81%. Comparing base (e52df75) to head (f83f7ce).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
ietf/meeting/views.py	75.00%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #11719      +/-   ##
==========================================
+ Coverage   88.75%   88.81%   +0.05%     
==========================================
  Files         337      337              
  Lines       45420    45547     +127     
==========================================
+ Hits        40311    40451     +140     
+ Misses       5109     5096      -13     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.