feat: add api key secret copy control

[gaoflow]

Summary

• add a Copy button beside the one-time API key secret
• copy through navigator.clipboard.writeText with a guarded textarea fallback
• show success/error feedback through the existing toast provider without logging or persisting the secret beyond existing state
• add tests for Clipboard API success, fallback copy, denied copy, and rapid repeated clicks

Closes #4

Verification

$ npm run lint

> stableroute-frontend@0.1.0 lint
> next lint

✔ No ESLint warnings or errors

$ npm test -- --runInBand

> stableroute-frontend@0.1.0 test
> jest --runInBand

PASS src/app/quote/page.test.tsx
PASS src/app/api-keys/page.test.tsx
PASS src/components/__tests__/Header.test.tsx
PASS src/__tests__/page.test.tsx
PASS src/components/__tests__/Spinner.test.tsx
PASS src/components/__tests__/Card.test.tsx
PASS src/components/__tests__/Badge.test.tsx
PASS src/lib/__tests__/format.test.ts

Test Suites: 8 passed, 8 total
Tests:       21 passed, 21 total
Snapshots:   0 total
Time:        0.71 s, estimated 1 s
Ran all test suites.

$ npm run build

> stableroute-frontend@0.1.0 build
> next build

✓ Compiled successfully
✓ Generating static pages (15/15)

Rendered smoke:

• Browser plugin was unavailable in this Codex session (Browser is not available: iab), so I used Playwright CLI fallback.
• npx playwright screenshot --full-page http://localhost:3000/api-keys /tmp/stableroute-api-keys-prod-smoke.png
• Production /api-keys rendered without a framework overlay.

[mikewheeleer]

thanks for jumping in @gaoflow! 🙏 we assign issues before work starts so two people don't build the same thing, and #4 isn't assigned to you. please grab an open unassigned issue and PR against that. closing this one for now, hope to see you back 💪