Issue a new API key from a recovery token

Consume a single-use recovery token (1-hour TTL, from the recovery email): a new API key is issued and every old key is revoked in one atomic batch. The token is consumed first, so if rotation ever fails the token is spent and a fresh link must be requested. The new key is shown exactly once. Balance, plan, receipts, and in-flight calls are unchanged.