Keys, rate limits, and usage counters

The gateway stopped being open. Keys live in KV, limits are enforced per key, and every call is counted.

• um_live_ / um_test_ keys, scoped and rotatable
• Per-key rate limiting, returning 429 with Retry-After