Cover openapi key get/get_list/update in org integration suite

[sdairs]

Summary

The service suite already exercises openapi_key_create + openapi_key_delete as part of the query-API flow. The read + update paths (openapi_key_get, openapi_key_get_list, openapi_key_update) have no live coverage.

Scope

• Create a synthetic key in the org suite, separate from the service-suite key.
• openapi_key_get_list — assert the new key appears.
• openapi_key_get — assert fields match what create returned.
• openapi_key_update — round-trip a property change (e.g. flip state enabled → disabled → enabled, or change description). Verify via get.
• Delete + cleanup at the end.

Where this lands

• crates/clickhouse-cloud-api/tests/integration_org_test.rs (new phase)

Notes

• Don't share the key with the service suite — keep them independent so a failure in one doesn't poison the other.
• Use the existing register_api_key cleanup hook.

Parent: #151