fix(api-keys): enforce upper bounds on consumer name, rate limit, rotation interval and grace period (closes #893)

[mopxam-art]

Summary

Enforces strict upper bounds and type validation on API-key management parameters in src/routes/apiKeys.ts and src/lib/apiKeys.ts:

• Caps consumer_name length to 128 characters and rejects empty/whitespace strings.
• Bounds rate_limit to positive integers not exceeding 1,000,000 req/min.
• Bounds rotation_interval_days to positive integers not exceeding 3,650 days (10 years).
• Validates grace_period_ms as an integer between 0 and 2,592,000,000 ms (30 days).
• Treats grace_period_ms: 0 explicitly as zero grace, immediately revoking old keys upon rotation.
• Re-exports ERROR_RATE_LIMIT_WINDOW_MS in src/lib/error-limiter.ts ensuring clean test suite execution.

Testing & Verification

• Added comprehensive unit tests covering boundary parameters, edge cases, input validation, and rotation lifecycle (src/__tests__/apiKeysBounds-5d.test.ts).
• Verified all unit test suites pass (npm test).
• Clean tsc --noEmit and npm run lint (0 errors).

Closes #893