M22.2 §1: API keys — table, settings page, bearer auth, rate limit

[n8bar]

M22 Phase 2, §1 of docs/strategies/22.2_API_KEYS_AND_CONTRACT.md.

• api_keys table + ApiKey model (SHA-256 hash stored, plain key shown once)
• Settings › API keys page: make, one-time reveal, list with last used, revoke
• AuthenticateApiKey middleware (alias api.key): bearer key → issuer; unknown/revoked → 401 unauthorized
• Per-key rate limit (API_RATE_LIMIT_PER_MINUTE, default 60); 429 rate_limited with Retry-After
• Errors use the docs/API.md format: {"error": {"code", "message"}}

Tests: 9 new (ApiKeyTest, ApiKeySettingsTest, ApiKeyAuthTest); full suite 662 pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01L5W7g1rrgyVqEwZSgLg2QM