feat(keys): add granular API key limits

[mahdiwafy]

Summary

• Adds optional API key limits: expiry, per-request max tokens, daily tokens, RPM/RPH/RPD, and rolling token windows.
• Records API-key usage after successful upstream calls.
• Exposes key limit fields in the dashboard key editor.

Scope

Focused only on API key limit storage/enforcement/UI.

PR #61 comparison

PR #61 adds allowed-model ACL columns. This PR adds limit fields and usage accounting. If PR #61 merges first, this branch may need a migration-number rebase, but the feature scope is separate.

Verification

• npm run lint:undef

[Vanszs]

Request for revision / separate feature discussion.

API-key expiry, rate limits, and token quotas are relevant to VansRouter, but this should be treated as a separate coordinated feature rather than adopted as-is.

Before adoption, please split the work and address:

• one unique, monotonic SQLite migration compatible with the existing migration registry;
• schema, repository, CRUD API, import/export, and dashboard consistency;
• centralized enforcement across the intended modalities, before provider lookup;
• atomic check/reserve behavior for concurrent requests and multi-process deployments;
• clear policy for whether /v1/models consumes request quota;
• streaming disconnect/error accounting;
• combo/fusion/fallback accounting;
• preservation of VansRouter ACL (allowedProviders, allowedCombos, allowedKinds), trusted internal paths, proxy behavior, and RTK/Caveman/Ponytail.

The feature direction is welcome. Please revise it into focused migration, persistence, enforcement, and testable accounting changes before adoption.

[mahdiwafy]

Superseded by focused #88 (tailscale) / #90 (api-key limits).