API key rotation and revocation support for integrators

[phertyameen]

Location

src/modules/accounts/ or a new src/modules/api-keys/

Problem

No confirmed mechanism lets an integrator rotate or revoke their own API key (e.g. after a suspected compromise) without contacting an operator directly, a standard expectation for any API-key-authenticated service.

Acceptance Criteria

• Integrator can generate a new key and revoke an old one via a self-service endpoint
• Revoked keys immediately stop authenticating, no caching delay
• Revocation and rotation events logged for audit purposes