audit follow-ups: deps floor, LICENSE, gate /debug/redis-keys

- requirements.txt: bump floors past known CVEs (flask>=2.3.2 fixes
  CVE-2023-30861, requests>=2.32.0 fixes CVE-2023-32681 + CVE-2024-35195,
  redis>=5.0 fixes CVE-2023-28858/9).
- LICENSE: add MIT text (README claimed MIT but the file was missing).
- /api/1/debug/redis-keys: require auth. Was unauthenticated info-disclosure
  on the LAN/AP side.

adacam_api/app.py

@@ -112,6 +112,7 @@ def create_app():
     
     # ── DEBUG ENDPOINTS ────────────────────────────────────────────────────
     @app.route('/api/1/debug/redis-keys')
+    @require_auth
     def redis_keys():
         """Debug endpoint — list Redis keys for GPS/IMU troubleshooting."""
         try: