Added php_sapi_name() CLI guard matching the pattern used in migrate.php
and cleanup_ratelimit.php. Without this, the script was web-accessible
and could generate an API key without authentication if no keys existed yet.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>