security: API Key 权限范围 + 过期时间 + 用量追踪

增强:
- 权限模板: readonly / monitor / full
- 每 key 独立权限列表, 注入 user['perms']
- 可选过期时间 (ttl 参数)
- 过期 key 自动清理 (加载时 + 验证时)
- request_count 用量追踪
- 标记 is_api_key = True

Co-Authored-By: Claude <noreply@anthropic.com>

services/web_panel/utils/auth.py

@@ -23,7 +23,7 @@ def panel_auth(handler, csrf_protect: bool = False):
             is_valid = True
             request['user'] = session_store[token]
 
-        # 2b. 从 API Key Store 验证 (服务器间调用)
+        # 2b. 从 API Key Store 验证 (服务器间调用 — 使用 key 自身权限)
         if not is_valid and token:
             from services.web_panel.routes.apikeys import validate_api_key
             key_info = validate_api_key(token)
@@ -31,8 +31,9 @@ def panel_auth(handler, csrf_protect: bool = False):
                 is_valid = True
                 request['user'] = {
                     "username": f"apikey:{key_info['name']}",
-                    "perms": ["admin"],
+                    "perms": key_info.get("permissions", ["framework.status.read"]),
                     "login_time": key_info.get("created_at", 0),
+                    "is_api_key": True,
                 }
 
         # 3. 拦截逻辑