core: implement API key authentication for vendors

[EmeditWeb]

Problem

Vendors need a programmatic way to integrate with
StepFi. Wallet-based JWT auth is not practical for
server-to-server communication.

What To Build

1. Create api_keys table in Supabase
2. CRUD endpoints for API key management
3. ApiKeyGuard for vendor endpoints

Files To Touch

• src/auth/guards/api-key.guard.ts (new)
• src/modules/vendors/vendors.controller.ts
• src/modules/vendors/vendors.service.ts
• supabase/migrations/[ts]_api_keys.sql

Acceptance Criteria

• API key generated and returned once
• Only hash stored in database
• ApiKeyGuard correctly authenticates
• Permissions enforced per key
• npm run build passes

Mandatory Checks Before PR

• npm run build passes
• No any types
• Unit tests for ApiKeyGuard
• PR references this issue

[EneGab]

I would like to work on this issue as quick as possible