feat(api-keys): wire up API key management with real authentication

[devwums]

Summary

Implements CRUD API key management (create, list, revoke, usage lookup) for the Sentinel API.

The api-keys module already existed on disk (apps/backend/src/modules/api-keys/) but had two blocking problems:

1. It was never registered in AppModule, so none of its routes were actually reachable.
2. It derived the target userId from an unauthenticated URL path parameter, explicitly flagged in a comment as "for demo purposes" — meaning any caller could create, list, or revoke another user's keys just by guessing their id.

Changes

• Register ApiKeysModule in AppModule.
• Controller now requires JwtAuthGuard and derives the acting user from the verified token via @CurrentUser(), matching the pattern already used by the invitations module. userId is no longer client-supplied.
• Service now injects the shared PrismaService instead of constructing its own PrismaClient.
• revokeApiKey/getApiKeyUsage scope their lookups by (id, userId) together, so a key ID belonging to another user reports as not-found instead of leaking its existence/ownership via a different error.
• Added CreateApiKeyDto validation (class-validator) and Swagger decorators (@ApiTags, @ApiBearerAuth, @ApiOperation) consistent with other modules — required since the app has a global ValidationPipe({ forbidNonWhitelisted: true }).
• Added unit tests for the service (key generation/uniqueness, hashing, ownership scoping, revoke idempotency, usage validation) and controller (verifying every route uses the authenticated user's id, never a client-supplied one).

Key generation and hashing (sk_-prefixed random key, SHA-256 hash at rest, only the hash ever persisted, last-4-chars preview) were already implemented correctly and are unchanged.

Acceptance criteria (from #109)

• CRUD endpoints implemented (create, list, revoke, usage)
• Secure key generation
• Revocation supported

Closes #109

Test plan

• npm run build — clean
• npx jest --config jest.backend.config.js apps/backend/src/modules/api-keys — 15/15 passing
• npx eslint on all changed files — clean (only pre-existing CRLF checkout noise on an untouched file, not part of this diff)