Update Api Key

PUT /keys/{id} renames a key. Scopes are fixed at creation (a key already handed out must not widen); a body that carries scopes is refused instead of silently ignored (arhangel66, #208).

One row of GET /keys / the body of GET|PUT|PATCH /keys/{id}: an allow-list, so the hash and the ciphertext are never sent. key is the whole key for a regular key (copyable any time) and the prefix and a mask for a billing key, which POST /keys shows once (key_retrievable false). What the key has spent and what it was refused come with it. The spent_* fields sum the ledger rows stamped with the key; a key whose pods were all billed before the stamp existed shows 0. refused_today counts this UTC day's budget refusals; last_refusal is the newest one ever, null for a key never refused.