Cancel My Account Delete

Reverse a pending soft-delete. Only succeeds inside the grace window (otherwise the row has already been hard-deleted and the api_key itself is gone, so the call gets a 401 from validate_key).

Because a soft-deleted key is in the blocklist, validate_key returns None. We therefore bypass it here and authenticate by looking the key up by its HMAC key_lookup directly — the only operation a blocked key can perform.

Round-3 hostile-review T1-28 — defense-in-depth: explicit _check_csrf_origin call. Cancel is reversible/idempotent but we still gate browsers on Origin/Referer to deny attackers the cheap signal of "key X is in the grace window".