feat: API Key 系统 — CRUD + panel_auth 集成 + 持久化

新增:
- services/web_panel/routes/apikeys.py — 创建/列表/删除 API Key
- panel_auth() 双重验证: Session Store → API Key fallback
- _check_plugin_auth() 支持 API Key
- API Key 持久化到 SenSuDB (config_kv 表)
- 格式: sk- + 48 hex chars
- 脱敏显示 (前8后4)
- 删除后立即失效 (401)

WebPanelManager 注册 apikeys 路由

Co-Authored-By: Claude <noreply@anthropic.com>

services/internet_service.py

@@ -336,7 +336,10 @@ class InternetService:
 
             session_store = request.app.get("panel_session_store", {})
             if token not in session_store:
-                return {"allowed": False, "reason": "会话无效或已过期"}
+                # 回退到 API Key 验证
+                from services.web_panel.routes.apikeys import validate_api_key
+                if not validate_api_key(token):
+                    return {"allowed": False, "reason": "会话无效或已过期"}
 
             # 2. 检查插件是否有网络访问权限
             permission_service = self.service_manager.get_service("permission")