feat(vnext2): add user key self-service skeleton

- PORTAL_KEY_EXPERIENCE.md: review from pending to approved
- KEY_SELF_SERVICE_API.md: review from pending to approved
- 0015_user_keys.sql: migration for key_records table
- user_keys_repo.go + test: SQLite repo (Create/ListByOwner/GetByID/UpdateStatus)
- key_self_service.go: HTTP handlers (POST/GET /api/keys, pause/resume/delete)
- key_self_service_svc.go: action wiring (buildUserKeyHandler)
- registered in ActionSet + NewAPIHandlerWithAuth

Note: full user auth requires host+CRM co-deployment.
Current skeleton accepts Bearer token for testing.

internal/store/sqlite/db.go

@@ -41,6 +41,7 @@ type Queries struct {
 	ProbeResults            *ProbeResultsRepo
 	AccessClosures          *AccessClosureRecordsRepo
 	ReconcileRuns           *ReconcileRunsRepo
+	UserKeys                *UserKeysRepo
 }
 
 type DB struct {
@@ -176,6 +177,10 @@ func (db *DB) ReconcileRuns() *ReconcileRunsRepo {
 	return db.queries.ReconcileRuns
 }
 
+func (db *DB) UserKeys() *UserKeysRepo {
+	return db.queries.UserKeys
+}
+
 func (db *DB) WithTx(ctx context.Context, fn func(*Queries) error) error {
 	tx, err := db.sqlDB.BeginTx(ctx, nil)
 	if err != nil {
@@ -222,6 +227,7 @@ func newQueries(db execQuerier) *Queries {
 		ProbeResults:            newProbeResultsRepo(db),
 		AccessClosures:          newAccessClosureRecordsRepo(db),
 		ReconcileRuns:           newReconcileRunsRepo(db),
+		UserKeys:                newUserKeysRepo(db),
 	}
 }