feat(api): configurable worker processes via API_WORKERS

Add a --workers / API_WORKERS option so the API can run multiple worker
processes in a single container for multi-core concurrency, without
needing to scale containers (which would conflict with the api service's
fixed container_name and complicate per-stack ops/monitoring).

The existing create_app() carries hardcoded defaults (sqlite:///./
meshcore.db, Redis off), so forked workers cannot use it — they would
open the wrong database and run without caching. Add an env-driven
factory, create_app_from_env(), that rebuilds the app from APISettings
plus the CLI-only env vars (CORS_ORIGINS, METRICS_ENABLED,
METRICS_CACHE_TTL), mirroring the single-process resolution. workers > 1
runs uvicorn against this factory via an import string; workers == 1
keeps the single-process object path so local CLI flags still apply.

Wire API_WORKERS into the api compose service (default 1, unchanged
behaviour) and document it in the README (new "Scaling the API"
section + env table) and the v0.12 upgrading notes, including the
SQLite single-host caveat and the env-vs-CLI-flag note for workers.

Tests: create_app_from_env reads DB/Redis/MQTT/metrics from env,
honours explicit overrides, and derives the collector DB path from
DATA_HOME rather than the bare create_app default.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -258,6 +258,11 @@ NODE_CLEANUP_DAYS=30
 # External API port
 API_PORT=8000
 
+# Number of API worker processes (default 1). Increase to use multiple CPU
+# cores under load — each worker is an independent process sharing the same
+# listening socket. All workers read configuration from these env vars.
+# API_WORKERS=1
+
 # API Keys for authentication
 # Generate secure keys for production: openssl rand -hex 32
 # Leave empty to disable authentication (not recommended for production)