Set an API key's publisher-only default

Turns the key's publisher_only default on or off. On: /v2/search and /v2/featured with this key return only charts imported from a licence-clean publisher (Our World in Data, USDA ERS, Eurostat, EEA) unless the call sends publisher_only itself — publisher_only=false still returns everything for that call. Takes effect on the next call. Session-authenticated (fresh account check), never with the key itself; private, no-store. Another account's key answers 404.