feat: add MCP endpoint and API key management

- Add ApiKey Prisma model (SHA-256 hash, prefix, lastUsedAt) with migration
- Implement ApiKeyService (create, list, delete, verify)
- Extend requireAuth middleware to accept sk_-prefixed API keys alongside JWTs
- Add GET/POST /api-keys routes for creating and revoking keys
- Add stateless Streamable HTTP MCP server at POST/GET /mcp exposing all 20
  time-tracking tools (clients, projects, time entries, timer, statistics,
  client targets and corrections)
- Frontend: ApiKey types, apiKeys API module, useApiKeys hook
- Frontend: ApiKeysPage with key table, one-time raw-key reveal modal, and
  inline revoke confirmation
- Wire /api-keys route and add API Keys link to Management dropdown in Navbar

frontend/src/components/Navbar.tsx

@@ -8,6 +8,7 @@ import {
   LogOut,
   ChevronDown,
   Settings,
+  Key,
 } from "lucide-react";
 import { useAuth } from "@/contexts/AuthContext";
 import { useState, useRef, useEffect } from "react";
@@ -40,6 +41,7 @@ export function Navbar() {
   const managementItems = [
     { to: "/clients", label: "Clients", icon: Briefcase },
     { to: "/projects", label: "Projects", icon: FolderOpen },
+    { to: "/api-keys", label: "API Keys", icon: Key },
   ];
 
   return (