Confirm Key Reset Execute

Execute the API key reset. Called by the form on the GET page.

Consumes the token, generates a new key, emails it, and shows it on the response page. This is the mutating side of the double-confirm pattern — the GET handler only renders the form so corporate email scanners can't burn the token by pre-fetching the link.