feat(api-keys): add ulink api-keys command to manage client SDK keys

[mohn93]

Why

The CLI had no way to manage a project's client SDK API keys — the key an app passes to UlinkSDK.initialize. Integrators had to open the dashboard, or use the MCP list_api_keys/create_api_key tools, which currently return 401 on the api-key/subscription routes. This adds a first-class CLI path that authenticates with the user's own ulink login session (or --api-key).

Command

ulink api-keys list    [--project-id <id>] [-p <dir>] [--json]
ulink api-keys create  --name "<name>" [--project-id <id>] [-p <dir>] [--json]
ulink api-keys revoke  <keyId>

• create prints the full key value once, with a "shown only once, cannot be retrieved again" warning; list returns metadata only (name, prefix, id, created) — the secret is never exposed there.
• Project id resolves from --project-id, then the saved directory config (ulink project set), then a single-project auto-select; ambiguity prints the choices and asks for --project-id.
• --json on list/create for scripting.

Implementation

• ULinkApiClient gains listApiKeys / createApiKey / revokeApiKey on top of the existing auth (_authHeaders: user JWT with refresh, or x-app-key), plus a _deleteWithRetry helper and api-key-specific error messages (a 401 points the user at ulink login).
• Response parsing is schema-tolerant: unwraps data / apiKeys / keys, best-effort detection of the secret field on create, and if the field can't be identified it prints the whole response rather than dropping the key.
• bin/ulink.dart: api-keys command with list / create / revoke subcommands, help routing, and a root help line. New ApiKeysCommand in lib/commands/.

Testing

Unit tests cover the network-free contract paths (help → 0; create without name / blank name → 2; revoke without key id → 2; unknown action → 2). Manually smoke-tested the compiled binary: --help for the command and subcommands, arg validation exit codes, and the unauthenticated auth-error message.

dart analyze lib bin test clean. dart test — 297 pass.

Notes

• Independent branch off main; no overlap with fix(verify): disclose skipped cross-checks and report URL schemes per platform #3 or fix(verify): resolve iOS bundle id per target, not first pbxproj match #4.
• This is also the practical unblock for the reported MCP 401 on list_api_keys/create_api_key: ulink api-keys create uses the CLI login JWT, which the dashboard-style api-key route accepts. The underlying MCP/API guard mismatch is separate (needs the ulink-api repo).