Caps on a Single API Key

A budget scoped to one API key is now enforced in the request path. The capped key is refused with HTTP 402 before the provider is called, and other keys in the same workspace keep working. Refusals are counted on the dashboard as they land.