api: API key authentication with rotation and grace period

- Add ApiKey Prisma model (keyHash, expiresAt, revokedAt)
- Protect /api/v1/* routes with Authorization: Bearer header check in hooks
- create rotateApiKey() utility: normal (48h grace) and emergency (immediate)
- Add Super-only /admin/api-keys page for key rotation with one-time reveal
- Fix roleId check by using parent layout's DB-fetched adminUser
- Add API Keys link to admin sidebar

src/lib/generated/prisma/internal/prismaNamespaceBrowser.ts

@@ -64,6 +64,7 @@ export const ModelName = {
   ProclamationCategory: 'ProclamationCategory',
   ProclamationCategorySubscriptionLevel: 'ProclamationCategorySubscriptionLevel',
   LicenseKey: 'LicenseKey',
+  ApiKey: 'ApiKey',
   SubscriptionLevel: 'SubscriptionLevel'
 } as const
 
@@ -239,6 +240,18 @@ export const LicenseKeyScalarFieldEnum = {
 export type LicenseKeyScalarFieldEnum = (typeof LicenseKeyScalarFieldEnum)[keyof typeof LicenseKeyScalarFieldEnum]
 
 
+export const ApiKeyScalarFieldEnum = {
+  id: 'id',
+  keyPrefix: 'keyPrefix',
+  keyHash: 'keyHash',
+  createdAt: 'createdAt',
+  expiresAt: 'expiresAt',
+  revokedAt: 'revokedAt'
+} as const
+
+export type ApiKeyScalarFieldEnum = (typeof ApiKeyScalarFieldEnum)[keyof typeof ApiKeyScalarFieldEnum]
+
+
 export const SubscriptionLevelScalarFieldEnum = {
   id: 'id',
   name: 'name',