feat(#567): admin UI for channel API keys

[sneumannb5]

What

Adds /admin/api-keys (create/list/revoke) for the channel API keys exposed by createAdminKeysRouter, which shipped in #438/#439 with no web-ui page. Closes #567 (follow-through from #550).

Why

Keys could only be minted via curl, and a public MCP key-binding (#550) is keyed on ApiKeyRecord.id - so an operator had to read that id out of the API by hand. Each key row now shows the id verbatim with a one-click copy, plus a reveal-once token, a scopes:[] guard, and a two-step revoke.

Test plan

• npm run typecheck in web-ui
• npx eslint app/admin/api-keys app/_lib/api.ts app/admin/page.tsx
• npx vitest run app/admin/api-keys - 15/15 pass (incl. copy-id flow + 2 concurrency regression guards)
• npm run i18n:check - en/de parity, 3379 keys
• manual: create key → copy id → paste into an MCP binding; revoke → confirm row flips to Revoked

Risk / blast radius

Frontend only — the channel-api router is unchanged (no schema, no public API, no env-var). Auth inherits the existing /api operator-session gate. No rotate path by design (revoke + replace).

Naming-decisions still pending

• route lives at /admin/api-keys (matches the feat(web-ui): admin UI for public API keys (issues #438/#439) #551 convention + card key apiKeys), not the literal /admin/keys from the issue title - confirm before merge

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}