Virtual key management

Scoped, expiring API keys with per-key rate limits and audit-friendly revocation.

Keys are issued in wa-{random} format and shown only once at creation; stored hashed thereafter.
Per-key rpm_limit, tpm_limit, and daily dollar budget, settable at creation or via PUT /keys/{id}.
Keys are disabled rather than hard-deleted, preserving audit trails, and can be rotated in place with POST /keys/{id}/rotate.