Set spend caps scoped to one API key

Applies spend caps that bind only calls authenticated with this key. A key's caps are metered against that key's own spend and merged with the owner's caps, the tighter of the two winning — so a key can narrow what it may spend but never widen it beyond what its owner allows, and a key cannot re-enable a bucket its owner disabled. Per field, null clears the cap, an omitted field leaves it alone, and 0 blocks all spend in that bucket.