feat(api): add api keys and branch api

[elitan]

Summary

• add API key creation, listing, and revocation
• add bearer auth for /api/v1
• add sync branch HTTP API with OpenAPI metadata
• update branch UI flows to use sync branch calls and return connection strings on create

API routes, procedures, contracts

Added:

• GET /api/v1/openapi.json
• GET /api/v1/api-tokens
• POST /api/v1/api-tokens
• DELETE /api/v1/api-tokens/{id}
• GET /api/v1/branches
• POST /api/v1/branches
• GET /api/v1/branches/{slug}
• DELETE /api/v1/branches/{slug}
• POST /api/v1/branches/{slug}/reset
• PATCH /api/v1/branches/{slug}/expiry

Updated:

• branches procedures now use slug-based sync create/delete/reset/expiry for normal branches
• branch create returns connectionUri
• /api/v1 accepts bearer API keys

Deleted:

• no API routes deleted

Checks

• bun run typecheck
• bun run test
• bun run web:build
• bash -n scripts/*.sh
• browser QA for API key create/revoke and bearer branch API