API keys — admin only; changes apply to new generations immediately, no restart

Keys are stored in the server's protected .env (0600). Current values are never shown — only the last 4 characters.