Token-Based API Authentication Phase 1 — Encourage migration

[bpepple]

~6 months. Goal: visibility, adoption metrics, reminder emails; Basic Auth still fully functional.

• api/authentication.py: DeprecatedBasicAuthentication wrapper tags requests authenticated via Basic
• api/middleware.py: attach Deprecation/Sunset response headers on Basic-authenticated responses
• Adoption metrics: Redis counters per auth method (Basic/Token/Session), structured logging
• users/management/commands/notify_basic_auth_users.py: monthly reminder emails
• api/README.md: mark Basic Auth deprecated with removal-date TBD, promote Token as primary
• Blog: progress updates in monthly posts + dedicated 'Introducing Token Authentication' post