feat: implement resource metadata management API (issue #12)

Add API endpoints to manage ResourceMetadata (ownership, groups, permissions)
for KV resources. This enables administrators to configure granular access
control for stored data.

Changes:
- Add GetResourceMetadataResponse and UpdateResourceMetadataRequest types
- Add GetResourceMetadata and SetResourceMetadata methods to AuthService
- Add GET /kv/{path}/metadata endpoint (requires admin:users:read)
- Add PUT /kv/{path}/metadata endpoint (requires admin:users:update)
- Both endpoints protected by JWT authentication
- Metadata routes registered before general KV routes to prevent pattern conflicts

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

auth/auth.go

@@ -198,6 +198,40 @@ func (s *AuthService) CheckResourcePermission(authCtx *AuthContext, resourceKey
 	return CheckPermission(metadata.Permissions, operation, isOwner, isGroupMember)
 }
 
+// GetResourceMetadata retrieves metadata for a resource
+func (s *AuthService) GetResourceMetadata(resourceKey string) (*types.ResourceMetadata, error) {
+	var metadata types.ResourceMetadata
+
+	err := s.db.View(func(txn *badger.Txn) error {
+		item, err := txn.Get([]byte(ResourceMetadataKey(resourceKey)))
+		if err != nil {
+			return err
+		}
+
+		return item.Value(func(val []byte) error {
+			return json.Unmarshal(val, &metadata)
+		})
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return &metadata, nil
+}
+
+// SetResourceMetadata stores metadata for a resource
+func (s *AuthService) SetResourceMetadata(resourceKey string, metadata *types.ResourceMetadata) error {
+	metadataBytes, err := json.Marshal(metadata)
+	if err != nil {
+		return fmt.Errorf("failed to marshal metadata: %v", err)
+	}
+
+	return s.db.Update(func(txn *badger.Txn) error {
+		return txn.Set([]byte(ResourceMetadataKey(resourceKey)), metadataBytes)
+	})
+}
+
 // GetAuthContext retrieves auth context from request context
 func GetAuthContext(ctx context.Context) *AuthContext {
 	if authCtx, ok := ctx.Value("auth").(*AuthContext); ok {