/account/api-keys is a real page now. Create a key with a name, see prefix,
created and last used, revoke it. The raw key is shown once in the response
and never stored - api_keys (migration 0025) holds a SHA-256 hash, the same
shape as sessions and organization_invitations. prefix is amelu_live_ plus 6
of the 43 random characters, purely so two keys can be told apart on screen.

Keys authenticate through auth.Require, which now takes either the session
cookie or Authorization: Bearer amelu_live_…, so every /api route accepted
them the moment the middleware changed - no per-route work. A key acts as its
owning customer with that customer’s organization role.