feat(metadata): sync cpa-key-policy keys

[RomarioAgro]

Summary

• fetch plugin-owned key metadata from GET /v0/management/plugins/cpa-key-policy/keys
• map plugin id to cpa_api_keys.api_key, name to alias, and key_preview to display key
• reconcile native and plugin snapshots by source so partial endpoint failures cannot delete metadata from another source
• keep disabled plugin keys identifiable for historical administrative usage
• prevent plugin IDs from authenticating through the native API-key login path

Why

Usage events and rollups already store the plugin key ID in api_group_key, but administrative Analysis joins those aggregates to cpa_api_keys. The existing metadata sync only imports native /v0/management/api-keys, so plugin-owned usage is dropped from administrative key composition.

Safety

• a successful explicit keys: [] reconciles only the plugin source
• 401, 404, 500, timeout, blank/invalid JSON and missing/null keys preserve previously known plugin metadata
• enabled=false does not mean deleted
• no plaintext plugin secret is requested or stored
• existing rows are migrated to source=native
• no frontend or authentication-provider changes

Tests

• metadata DTO and response validation
• native + plugin and two-plugin-key snapshots
• partial failure and explicit empty snapshot
• disabled key and native login isolation
• backward-compatible migration
• historical administrative Analysis without rebuild/reaggregation
• full go test -timeout 2m -p 1 ./...