REPO-008 [HIGH] Hash all legacy plaintext API keys and drop plaintext column

[kilodesodiq-arch]

ApiKey.key column stores plaintext API keys. The guard accepts plaintext comparison. File: schema.prisma line 387, api-key.guard.ts line 48. Risk: all keys compromised on DB breach. Migrate to hash-only storage.