fix(api-keys): reject invalid JSON bodies

[rissrice2105-agent]

Fixes #120.

What changed

• parse API-key creation bodies explicitly instead of replacing JSON failures with {}
• reject malformed, null, and array JSON payloads with HTTP 400
• preserve the default API key label for valid JSON objects only
• add regression coverage proving invalid payloads cannot reach key creation

Validation

• pnpm --filter @aiornot/web exec vitest run lib/api-key-request.test.ts (3/3)
• pnpm --filter @aiornot/web test (107/107)
• pnpm --filter @aiornot/web typecheck
• pnpm --filter @aiornot/web lint (0 errors; 7 existing warnings)
• git diff --check