api: API key authentication with rotation and grace period

- Add ApiKey Prisma model (keyHash, expiresAt, revokedAt)
- Protect /api/v1/* routes with Authorization: Bearer header check in hooks
- create rotateApiKey() utility: normal (48h grace) and emergency (immediate)
- Add Super-only /admin/api-keys page for key rotation with one-time reveal
- Fix roleId check by using parent layout's DB-fetched adminUser
- Add API Keys link to admin sidebar

src/routes/(protected)/+layout.svelte

@@ -55,6 +55,14 @@
 							{model.displayName}
 						</a>
 					{/each}
+					<a
+						href="/admin/api-keys"
+						class="rounded px-3 py-1 text-sm transition-colors {isActive('/admin/api-keys')
+							? 'bg-blue-50 text-blue-700 dark:bg-gray-800 dark:text-gray-100'
+							: 'text-blue-600 hover:bg-gray-50 hover:text-blue-800 dark:text-gray-400 dark:hover:bg-gray-800 dark:hover:text-gray-100'}"
+					>
+						API Keys
+					</a>
 				</div>
 			</div>
 		{/if}