fix(api-keys): Fehlversuche je Client-Netz zählen (IPv6 /64)

Wie der Throttler seit 886b4e7: die Sperre nach abgelehnten Schlüsseln
zählt über rateLimitSubject, damit wechselnde Adressen im eigenen
IPv6-/64 das Budget nicht zurücksetzen. Im Log steht weiter die Adresse.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/api-keys/api-keys.service.ts

@@ -16,6 +16,7 @@ import { UpdateApiKeyDto } from './dto/update-api-key.dto';
 import { isIpAllowed, normalizeAllowlistEntry } from './ip-allowlist';
 import { PermissionResolverService } from '../auth/permissions/permission-resolver.service';
 import { FailedAttemptLimiter } from './failed-attempt-limiter';
+import { rateLimitSubject } from '../common/throttler/rate-limit-subject';
 
 function normalizeAllowlist(entries: readonly string[] | undefined): string[] {
   return [
@@ -211,7 +212,10 @@ export class ApiKeysService {
     clientIp?: string,
   ): Promise<ApiKeyPrincipal | null> {
     const source = clientIp ?? 'unknown';
-    if (this.failures.isBlocked(source)) {
+    // Counted per client network like the throttler (IPv6 /64), so rotating
+    // addresses inside one's own prefix does not reset the budget.
+    const subject = clientIp ? rateLimitSubject(clientIp) : 'unknown';
+    if (this.failures.isBlocked(subject)) {
       // Same body shape as the built-in 4xx exceptions (JSON object, not a
       // bare string), so clients can read `message` uniformly.
       throw new HttpException(
@@ -236,9 +240,9 @@ export class ApiKeysService {
     this.logger.warn(
       `API key rejected (${result.reason}): ${prefix} from ${source}`,
     );
-    if (this.failures.recordFailure(source)) {
+    if (this.failures.recordFailure(subject)) {
       this.logger.warn(
-        `API key attempts from ${source} blocked for ${API_KEY_FAILURE_LIMIT.windowMs / 60_000} minutes after ${API_KEY_FAILURE_LIMIT.maxFailures} failures`,
+        `API key attempts from ${subject} blocked for ${API_KEY_FAILURE_LIMIT.windowMs / 60_000} minutes after ${API_KEY_FAILURE_LIMIT.maxFailures} failures`,
       );
     }
     return null;