Add API key management commands

[piekstra]

Why

During annual key rotations, managing API keys requires hand-crafting NerdGraph GraphQL mutations which is error-prone and hard to remember. First-class CLI commands make key operations ergonomic and scriptable.

Summary

• Add nrq keys list — search keys with optional --type and --account filters
• Add nrq keys get <id> — inspect a specific key (auto-detects type if --type omitted)
• Add nrq keys create --type user|ingest --name <name> — create user or ingest keys
• Add nrq keys update <id> — update key name/notes (auto-detects type if --type omitted)
• Add nrq keys delete <id>... — delete one or more keys with confirmation prompt
• API layer in api/keys.go wrapping NerdGraph apiAccess queries and mutations
• 25 unit tests with mock server fixtures

Test plan

• make verify passes (fmt, lint, tests)
• Smoke test: nrq keys create --type user --name "test-key", then list, get, update --name, delete

Closes #82