feat(api-keys): restrict keys to source IP addresses

A key can be limited to IP addresses or CIDR networks (e.g. the Wabenhain
server); a stolen key is useless from anywhere else. Requests from other
addresses get 403 "not allowed for this IP" and a log line. The admin UI
asks for the addresses when creating a key, warns when a key works from
anywhere, shows the last source address and can take it over into the
allowlist - changing the list needs no new key (PATCH /api-keys/:id).

Also: a key can only carry scopes its creator holds.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/prisma/schema.prisma

@@ -147,6 +147,10 @@ model ApiKey {
   createdByUser   User?     @relation(fields: [createdByUserId], references: [id])
   createdAt       DateTime  @default(now())
   lastUsedAt      DateTime?
+  // Absender-IP der letzten Nutzung - hilft beim Einrichten der Allowlist.
+  lastUsedIp      String?
+  // Nur von diesen Adressen/Netzen (IP oder CIDR) gueltig; leer = ueberall.
+  allowedIps      String[]  @default([])
   expiresAt       DateTime?
   revokedAt       DateTime?