### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate

### The Feature

Add an opt-in strict authentication mode for `GET /claude-code/marketplace.json` that requires a valid LiteLLM key in the `Authorization` header

A possible configuration shape is:

```yaml general_settings: claude_code_marketplace_auth_required: true ```

When enabled, the expected behavior is:

- Missing `Authorization` header returns `401` with `WWW-Authenticate: Bearer` - Malformed or invalid LiteLLM credentials return `401` - A valid LiteLLM Virtual Key or master key returns `200` with the marketplace catalog - A valid key that is not authorized for the route returns `403` according to the normal LiteLLM authorization rules - Credentials supplied through `?key=` are not accepted in strict mode - Authentication failures must not fall back to the anonymous public catalog

The setting should default to `false` so existing installations retain the current public discovery behavior

The existing authenticated marketplace management endpoints should remain unchanged

### Current behavior

The current `GET /claude-code/marketplace.json` route has n…