routes: admin endpoints for gateway key management

[joelpeace48-cell]

Problem

Once API keys exist there is no way to issue, list, rotate, or revoke them
without direct database access. That makes onboarding a pilot partner a manual
engineering task, and revocation during an incident far slower than it should
be.

What to do

• POST /v1/admin/keys — issue a key. Return the plaintext exactly once,
  store only the hash, and say clearly in the response that it will not be shown
  again.
• GET /v1/admin/keys — list metadata only: prefix, scopes, created, last used.
  Never the key itself.
• POST /v1/admin/keys/:id/rotate — issue a replacement with an overlap window
  so the partner can migrate without downtime.
• DELETE /v1/admin/keys/:id — immediate revocation, effective without a
  restart or cache expiry.
• Every admin action written to an append-only audit log: who, what, when.

Acceptance criteria

• Full lifecycle: issue, list, rotate, revoke
• Plaintext returned once only; hash stored
• Revocation effective immediately
• Admin actions audit-logged
• Admin routes require the admin scope, tested

Notes

Test that revocation takes effect immediately. A key cached in memory for five
minutes is a five-minute window during an incident, which is exactly when it
matters.