Typed ApiKeyScope — canonical scope values with parse-time validation

[yacosta738]

Goal

Replace the opaque string-based ApiKeyScope with a closed set of canonical
scope values validated at parse time.

Background

ApiKeyScope::parse(value) currently accepts any non-empty string. This means
invalid scope values can be stored in the database silently, and enforcement code
has no exhaustive list to check against.

Closes part of #46.

Acceptance Criteria

• A KnownScope enum (or constants) defines the valid scope values:
  chat:read, chat:write, providers:read, providers:write, admin
• ApiKeyScope::parse returns Err(ApiKeyValidationError::UnknownScope)
  for values not in the canonical set
• CreateApiKeyRequest and UpdateApiKeyRequest validate scopes before
  calling the repository
• Existing DB rows with unknown scope values are not rejected on read
  (unknown values are preserved but logged as warnings)
• Unit tests cover all valid scopes, an unknown scope, and an empty string

Scope

In scope: rook-core/src/api_key.rs, rook-usecases/src/manage_api_keys.rs

Out of scope: Route-level enforcement (that is Issue 2)

Verification

cargo test -p rook-core
cargo test -p rook-usecases

[linear-code]

DALLAY-396