feat(api): emit Deprecation/Sunset headers on legacy endpoints

[revtex]

Adds RFC 8594 deprecation headers, structured per-request warn logs, and an admin dashboard banner listing API keys that still hit the legacy surface. Purely additive — no legacy behaviour changes.

Backend

• `middleware.Deprecated(successor, sunset)` attaches `Deprecation: true`, `Sunset`, `Link: ; rel="successor-version"`, and `Cache-Control: no-store` to every legacy `/api/*` and legacy WebSocket route.
• Per-request `slog.Warn("legacy endpoint hit", method, path, apiKeyIdent)` — `apiKeyIdent` is the truncated identifier (set by `APIKeyAuth` alongside `apiKeyID`), never the raw key.
• New `GET /api/v1/admin/legacy-usage` endpoint returning a 24-hour aggregate of `{method, path, apiKeyIdent, count, lastSeen}` rows, backed by an in-memory ring buffer (no schema change).

Frontend

• `LegacyUsageBanner` on the admin dashboard reads `/api/v1/admin/legacy-usage`, polls every 60s, and is dismissable per session via `sessionStorage`. Expandable details table with method, path, API key, count, and last-seen relative time.

Tests

• backend/internal/middleware/deprecation_test.go — header emission + ring buffer behaviour.
• backend/internal/handler/admin/legacyusage/handler_test.go — aggregate endpoint.
• frontend/src/components/admin/LegacyUsageBanner.test.tsx — loading, empty, populated, and dismissed states.
• All 201 frontend tests + full Go test suite green.

Compatibility

No legacy route behaviour changed. Existing clients see the new response headers and ignore them; functional responses are byte-identical.