Marketplace Delete Keys

[hayesZach]

Closes CSF-884
Closes CSF-876
Refs CSF-881

---

Note

Medium Risk
Adds a new authenticated DELETE endpoint that permanently deletes API keys; mistakes in the ownership/environment checks or transaction handling could allow unintended deletions or block legitimate ones.

Overview
Adds marketplace support for deleting API keys via DELETE /keys/{id}.

The new handler performs deletion inside a private DB transaction and enforces safety checks (same marketplace slug, same environment, and disallows deleting the key currently used for authentication), with improved error logging/response mapping.

Expands test coverage significantly for the delete flow (middleware/auth/permissions, bad inputs, ownership/env mismatch, and context errors) and adds shared test helpers in internal/testutil for creating a marketplace+key and building authenticated requests.

^{Written by Cursor Bugbot for commit 896012e. This will update automatically on new commits. Configure here.}

[linear]

CSF-884 Delete Key for Marketplace

CSF-876 Marketplace Endpoints

CSF-881 Implement Endpoints

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}