docs: add a narrative API Keys guide

[islandbitcoin]

Adds a hand-written API Keys section to the docs overview (docs.flashapp.me), matching the existing landing-page style (code samples, sidebar link, .notice box).

Covers, for an integrator:

• What API keys are for (server-to-server / third-party), the fk_<keyId>_<secret> format, hash-only storage, and the shown-once secret.
• Creating a key with apiKeyCreate (from a user session — keys can't manage keys).
• Authenticating via the X-API-KEY header (not Authorization), with a curl example.
• The deny-by-default scope table (read_user … admin, write_* implies read_*, admin implies all) and that login/2FA/key-management are never key-accessible.
• Rate limits — the TOO_MANY_REQUESTS GraphQL error with retryAfterSeconds.
• Managing keys — apiKeys / apiKeyRotate / apiKeyRevoke.

Content is src/index.html (the source), mirrored into public/index.html so it's correct even if a deploy build doesn't regenerate. The auto-generated schema reference will pick up the apiKey* types once the feature reaches the production API the docs introspect.

🤖 Generated with Claude Code

[islandbitcoin]

Superseded by #4 (spectaql → Magidoc migration), which removes the custom src/index.html landing this PR edited. The API Keys guide content is preserved as guides/api-keys.md in #4 — nothing is lost. Closing.