feat(web-ui): admin UI for public API keys (issues #438/#439)

[Weegy]

Summary

Adds the admin UI for the public API keys introduced by #438/#439: create,
list, and revoke server-to-server bearer credentials for
POST /api/public/v1/chat at /admin/api-keys — create/list/revoke against
/api/public/v1/admin/keys, gated by the same operator-session cookie every
other admin page uses.

Stacked on #549 (feat/issue-438-439-public-api) since that hasn't merged
yet — this PR targets that branch, not main.

What's in this page

• Create: label (optional), rate limit (optional, 1–6000 req/min,
  integers only), and the single chat:write scope checkbox (hardcoded —
  it's the only scope that exists today).
• Reveal-once token: a created key's plaintext token is shown exactly
  once, right after creation, and is never re-derived from a list reload
  (the list endpoint never returns a token field). The create form —
  button and every field — is disabled while that reveal is still on
  screen, so a second create can never silently overwrite the first key's
  only-ever-shown token before it's copied.
• Revoke: two-step arm-then-confirm per row. Busy/confirm state is
  tracked per key id (not a single shared value), so concurrent revokes on
  different rows don't clobber each other's UI state.
• List reload sequencing: a monotonic counter guards against an
  out-of-order response (a slower in-flight fetch) overwriting a newer
  one's result.
• Errors: known backend error shapes (not_found,
  operator_auth.unavailable, auth.missing/auth.invalid,
  invalid_request) map to translated catalog messages under
  adminApiKeys.errors.*; nothing renders the raw backend response body.
• Dates use useFormatter().dateTime(...), not toLocaleString().

Review history

A codex adversarial review round found 5 blocking findings against the
initial version of this page (token-overwrite bug, two race conditions,
a Lume state-color violation, and a hard i18n-rule violation) plus one
lower-severity note (decimal rate-limit input silently truncated). All 5
are fixed in this PR — see the commit for the fix-by-fix breakdown — and
a re-review round confirmed the fixes.

Test plan

• npm run typecheck — clean
• npm run lint (api-keys dir) — clean
• npm run i18n:check — 0 errors, no new "identical to en" warnings
• npx vitest run — 409/409 tests, 54/54 files (under the repo's
  pinned Node 22.22.3 — a system Node version mismatch in the sandbox
  breaks 5 unrelated, pre-existing tests in toolTemplates.test.ts on
  newer Node; confirmed unrelated to this diff)
• Two new interaction-level tests exercise the token-overwrite fix and
  the concurrent-revoke race-condition fix directly via React Testing
  Library fireEvent
• Live-browser (Interceptor) visual check — attempted, blocked by an
  unrelated pre-existing dev-server bug (Turbopack/Tailwind 500s on
  every page due to a literal text-[color:var(...)] example string in
  doc comments in two untouched test files); not something this PR
  introduced or is in scope to fix

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}