Self-serve API keys: create, rotate, revoke

The manage-keys dialog on waldo.fyi/build/get-started is no longer read-only. You can create a key directly, rotate an existing key, or revoke one, without going through the guided setup flow. Rotation also works from the API keys page in workspace settings.

Rotation mints the new key and retires the old one in a single transaction, carrying over the old key’s name and expiry, so there is never a moment with zero valid keys or two live ones. Create, rotate, and revoke are all durably audit-logged.