Auth refactor 3/10 — Absorb the api-key package (expand)

[pranavp10]

This ticket was generated by AI (to-tickets) from #43.

Parent

#43

What to build

Move the standalone api-key package's logic into the shared auth package, split by concern, while keeping everything working. Pure key generation/hashing helpers go to a dependency-light @reloop/auth/apikey export (no Elysia, no Redis); validation logic becomes available to the middleware layer. Leave the old @reloop/apikey as a thin re-export shim so all current importers keep working untouched — this is the expand step; deletion happens in the contract ticket.

Acceptance criteria

• @reloop/auth/apikey exports the generation/hashing helpers (generate, hash, key-start, prefix) with no Elysia/Redis dependency
• API-key validation logic is available for the middleware plugin to consume
• @reloop/apikey remains as a thin re-export shim; every existing importer still builds green without changes
• Unit tests cover the generation/hashing helpers
• Tripwire (Auth refactor 1/10 — Test harness + characterization tripwire #44) still passes

Blocked by

• Auth refactor 2/10 — Single-source Better Auth config + split package exports #45