API key management

Teams can now generate API keys from the dashboard for programmatic access. Keys can be named, scoped, and revoked. The key is shown once on creation — store it securely.