feat: implement OpenAI-compatible Realtime API with authentication and management features

- Added support for public Realtime API, including new routes for managing API keys and handling WebRTC connections.
- Introduced RealtimeApiKey model and associated CRUD operations for admin management of API keys.
- Implemented authentication mechanisms for API keys and client secrets.
- Enhanced environment configuration with new secrets for Realtime API.
- Created OpenAIRealtime session management and event processing for real-time interactions.
- Updated schemas and settings to accommodate new features and ensure compatibility with existing systems.

backend/settings.py

@@ -38,6 +38,14 @@ AUTH_TOKEN_EXPIRE_MINUTES = int(os.getenv("AUTH_TOKEN_EXPIRE_MINUTES", "1440"))
 AUTH_COOKIE_SECURE = os.getenv("AUTH_COOKIE_SECURE", "false").lower() == "true"
 AUTH_COOKIE_SAMESITE = os.getenv("AUTH_COOKIE_SAMESITE", "lax")
 
+# ---- Public Realtime API auth ----
+# Keep public integration credentials separate from the admin login cookie.
+# Production deployments should set a dedicated random secret.
+REALTIME_TOKEN_SECRET = os.getenv("REALTIME_TOKEN_SECRET", AUTH_SECRET_KEY)
+REALTIME_CLIENT_SECRET_TTL_SECONDS = int(
+    os.getenv("REALTIME_CLIENT_SECRET_TTL_SECONDS", "60")
+)
+
 # ---- WebRTC STUN / TURN ----
 # Override STUN_URL in remote deployments to use the colocated coturn server
 # instead of waiting for a public STUN service that may be unreachable.