Add trusted AI access keys

[Clearner1]

What changed

• add one revocable trusted AI key that survives API service restarts while storing only its SHA-256 hash
• limit trusted access to 20 calls per minute and 200 calls per day
• relax temporary connections to 10 minutes and temporary tokens to 1 hour / 100 calls
• update the AI Access page to generate, copy, reset, and revoke access without browser persistence

Why

The one-time connection flow was safe but too short-lived for routine note capture. Trusted keys provide low-friction repeat access while preserving the same three-operation API boundary and an immediate revoke path.

Validation

• npm run check
• git diff --check
• no browser or E2E testing; real-device acceptance remains with the user