api: API key authentication with rotation and grace period

- Add ApiKey Prisma model (keyHash, expiresAt, revokedAt)
- Protect /api/v1/* routes with Authorization: Bearer header check in hooks
- create rotateApiKey() utility: normal (48h grace) and emergency (immediate)
- Add Super-only /admin/api-keys page for key rotation with one-time reveal
- Fix roleId check by using parent layout's DB-fetched adminUser
- Add API Keys link to admin sidebar

src/lib/generated/prisma/models.ts

@@ -21,5 +21,6 @@ export type * from './models/SolfeggioFrequency.ts'
 export type * from './models/ProclamationCategory.ts'
 export type * from './models/ProclamationCategorySubscriptionLevel.ts'
 export type * from './models/LicenseKey.ts'
+export type * from './models/ApiKey.ts'
 export type * from './models/SubscriptionLevel.ts'
 export type * from './commonInputTypes.ts'