feat(api-keys): add api key expiration

[rabsqueen]

Summary

Implements #108 by completing the API key entity with expiration support
while preserving the existing ownership and revocation relationships.

Changes

• Added optional expiresAt field to ApiKey.
• Added an index on expiresAt for efficient expiration queries.
• Preserved the existing User -> ApiKey ownership relationship.
• Preserved cascading deletion when an owning user is deleted.
• Preserved unique API key and key hash constraints.
• Generated the corresponding Prisma migration.

API Key Entity

The ApiKey entity now supports:

• Ownership through userId.
• Unique API key identification.
• Hashed key storage.
• Optional expiration.
• Revocation tracking.
• Last-used tracking.
• Creation timestamp.

Database

Generated Prisma migration:

add_api_key_expiration

Validation

• npx prisma validate
• npx prisma format
• npx prisma generate
• npx prisma migrate status
• npm run format:check
• npm run lint
• npm run typecheck
• npm test
• npm run build

Closes #108