test(api-keys): add end-to-end API key lifecycle integration tests

[Unclebaffa]

A comprehensive summary of the implemented API key lifecycle tests and verification results has been compiled in walkthrough.md.

Summary Overview

1. POST /api/v1/api-keys:

   • Asserts 201 Created with key starting with srk_ (/^srk_[0-9a-f]+$/) and echoed label.
   • Validates label boundary length up to 64 characters.
   • Rejects empty labels (""), labels > 64 chars, and missing/non-string labels with 400 invalid_request and requestId.

2. GET /api/v1/api-keys:

   • Projects non-sensitive metadata only: 8-character prefix, label, createdAt, scopes.
   • Security assertions: Explicitly asserts key is not present on any item and raw secret material never leaks into the response string.

3. DELETE /api/v1/api-keys/:prefix:

   • Removes key by 8-character prefix returning 204 No Content.
   • Confirms key is removed from listing.
   • Returns 404 not_found with requestId for unknown or duplicate deletions.

4. End-to-End Sequential Integration Suite:

   • Full flow test: POST -> GET (verify prefix & secrecy) -> DELETE (204) -> GET (confirm removal) -> DELETE (404).

5. Verification:

   • Build: npm run build (0 errors)
   • Lint: npm run lint (0 errors)
   • Tests: npm test (35 test suites / 390 tests passed)
   • Coverage: >98% overall repository coverage
   • Git Branch: Committed (c2b5708) and pushed to origin/test/api-keys-35-lifecycle-prefix.

Closes #281

[mikewheeleer]

nice one — in it goes 👍