feat: API key rotation and revocation (#40)

[wendyamoni-creator]

Summary

Closes #40.

Publishers can now rotate their API key via POST /publishers/me/api-keys/rotate. The old key is invalidated immediately; the new plaintext key is returned once in the response.

Changes

File	Change
drizzle/0012_api_key_rotation.sql	New migration — adds api_key_revoked_at column to publishers
src/db/schema.ts	apiKeyRevokedAt nullable timestamp field
src/middleware/apiKeyAuth.ts	Rejects keys where apiKeyRevokedAt IS NOT NULL
src/services/publisherService.ts	rotateApiKey() — single atomic UPDATE that swaps the hash
src/routes/publishers.ts	POST /publishers/me/api-keys/rotate route
src/routes/publishers.api-key-rotation.test.ts	9 new tests (new file)
src/routes/publishers.test.ts	Fix authedPublisher fixture — add apiKeyRevokedAt: null

How it works

• Rotation: rotateApiKey() does one atomic UPDATE — sets apiKeyHash to the new hash and sets apiKeyRevokedAt = null. The old key's hash is overwritten so it matches nothing on the next lookup.
• Explicit revocation (e.g. admin): set apiKeyRevokedAt to a timestamp without changing the hash. apiKeyAuth rejects any key whose row has a non-null apiKeyRevokedAt, even if the hash still matches.

Acceptance criteria

• The old key returns 401 after rotation
• The new key works (200)
• Tests cover both cases

Tested

Test Files  2 passed (2)
     Tests  25 passed (25)
```  closes #40 

[drips-wave]

@wendyamoni-creator Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@wendyamoni-creator is attempting to deploy a commit to the work Team on Vercel.

A member of the Team first needs to authorize it.