API key policy management

[BadgerOps]

Summary

• add API key policy settings for default expiry, maximum lifetime, rotation reminders, and per-role scope ceilings
• show API key age, expiration status, days until expiry, and rotation-due state in the UI
• fix the Nix dev shell Go toolchain path so make cover and make cover-threshold run under the selected Go toolchain
• document the new settings in AUTH_FLOWS, OpenAPI, and the versioned changelog

Closes #133.

Validation

• env XDG_CACHE_HOME=/tmp/nix-cache nix develop -c go test ./internal/api ./internal/auth ./internal/domain
• env XDG_CACHE_HOME=/tmp/nix-cache nix develop -c npm run build (from ui/)
• env XDG_CACHE_HOME=/tmp/nix-cache nix develop -c make cover (56.0% total coverage)
• env XDG_CACHE_HOME=/tmp/nix-cache nix develop -c scripts/pre-commit

Issue notes

• P1: Increase test coverage to 80% #67 remains open: coverage tooling now runs, but total coverage is 56.0%, below the 80% target.
• Account Lockout & Failed Login Tracking #134 is already closed.