API keys

Keys authenticate agents via X-API-Key: tst_…. Raw keys are shown once; only hashes are stored.