List the API keys associated with the authenticated user.

iter_066 #487: GET was previously 405. Customers had no way to inventory their own keys; rotation forced a DELETE + recreate even when the user just wanted to verify a key existed.

Returns the calling key (always) plus any sibling keys on the same user account. Key strings themselves are TRUNCATED — only the first 8 chars + ... + last 4 chars are returned (Stripe-style fingerprint) so leaked logs can't reconstruct working credentials. To actually use a key the customer must remember the one they got at creation time; we don't store an un-truncated copy retrievable by ID.