feat: Object-level permissions for ProcessingService API key management

[mihow]

Summary

Processing service API key generation and revocation should be gated by object-level permissions rather than the current is_staff check. Currently any staff user can rotate the API key for any processing service in any project.

Current state

• ProcessingServiceViewSet uses IsActiveStaffOrReadOnly — any staff user can create PS, generate keys, etc.
• No object-level (guardian) permission checks on ProcessingService
• API key generation (generate_key action) has no project-scoping

Proposed changes

Once #1110 lands (model-level permissions framework), add:

1. A new permission: manage_apikey_processingservice — "Can generate and revoke API keys for a processing service"
2. Add it to the appropriate role(s) in the permissions framework (e.g., project managers/admins)
3. Gate generate_key and a new revoke_key endpoint behind this permission
4. Ensure the permission check is project-scoped — the user must have the permission on at least one project the PS belongs to

Context

• Processing services authenticate with Antenna using API keys (added in the API key auth feature branch)
• Key rotation revokes all existing keys, so it's a destructive operation that affects running workers
• A revoke_key endpoint should also be added (currently revocation is admin-only)

Depends on

• feat: Add model-level permissions framework (rebase test - no not merge) #1110 (model-level permissions framework)