API keys: add read/read_write scopes + admin scope selector & pagination

Foundation for extending the Bearer API beyond create-only:
- api_keys gains a scope column (read | read_write); baseline schema updated
  and the column applied to the live DB. Existing keys default to
  read_write so the hwmon create key keeps working.
- ApiKeyModel: createKey() takes a validated scope; validateKey() always
  surfaces scope (defaults read_write); getAllKeys() is paginated
  ({keys,total,page,perPage}, key_hash stripped).
- ApiKeyAuth: expose getKeyContext() (scope/key_name/created_by/api_key_id)
  and requireScope() (403 on insufficient scope); existing return values
  unchanged.
- create_ticket_api.php: require read_write scope (a read key can't create).
- Admin /admin/api-keys: scope selector on the create form, a scope column,
  and pagination (revoked keys were stacking up).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

api/generate_api_key.php

@@ -59,12 +59,19 @@ try {
 
     $keyName = trim($input['key_name'] ?? '');
     $expiresInDays = $input['expires_in_days'] ?? null;
+    $scope = $input['scope'] ?? 'read_write';
 
     if (empty($keyName)) {
         http_response_code(400);
         throw new Exception("Key name is required");
     }
 
+    // Validate scope — only the two known values are allowed
+    if (!in_array($scope, ['read', 'read_write'], true)) {
+        http_response_code(400);
+        throw new Exception("Invalid scope: must be 'read' or 'read_write'");
+    }
+
     if (strlen($keyName) > 100) {
         http_response_code(400);
         throw new Exception("Key name must be 100 characters or less");
@@ -86,7 +93,7 @@ try {
 
     // Generate API key
     $apiKeyModel = new ApiKeyModel($conn);
-    $result = $apiKeyModel->createKey($keyName, $_SESSION['user']['user_id'], $expiresInDays);
+    $result = $apiKeyModel->createKey($keyName, $_SESSION['user']['user_id'], $expiresInDays, $scope);
 
     if (!$result['success']) {
         throw new Exception($result['error'] ?? "Failed to generate API key");
@@ -99,7 +106,7 @@ try {
         'create',
         'api_key',
         $result['key_id'],
-        ['key_name' => $keyName, 'expires_in_days' => $expiresInDays]
+        ['key_name' => $keyName, 'expires_in_days' => $expiresInDays, 'scope' => $scope]
     );
 
     // Clear output buffer
@@ -112,6 +119,7 @@ try {
         'api_key' => $result['api_key'],
         'key_prefix' => $result['key_prefix'],
         'key_id' => $result['key_id'],
+        'scope' => $result['scope'],
         'expires_at' => $result['expires_at']
     ]);
 } catch (Exception $e) {