fix(api): defer API-key database initialization

[dirtybits]

Summary

• defer GET /api/keys database initialization until a valid signed-header or bearer-key authentication path performs SQL
• keep signed nonce consumption and bearer-key lookup behavior unchanged
• add regressions proving malformed, invalid, and absent GET credentials return without initializing the database or issuing SQL
• document the focused implementation and verification in .agents/plans/defer-api-key-db-init.plan.md

Test Plan

• npm test --workspace @agentvouch/web -- __tests__/api/keys-route.test.ts --maxWorkers=1 --no-fileParallelism (24 tests)
• npm run format:check
• npm run lint:web
• npm run typecheck
• npm test --workspace @agentvouch/web -- --maxWorkers=1 --no-fileParallelism (128 files / 928 tests)
• npm exec --workspace @agentvouch/web -- next build --webpack
• git diff --check

Notes

No live API-key, wallet, database, or deployment flow was run. The webpack build passed with the repository's existing ox/viem dynamic-dependency warning and expected static-generation fallback logs because local DATABASE_URL is absent.