Auth refactor 10/10 — Contract: repoint generation importers & delete the api-key shim

[pranavp10]

This ticket was generated by AI (to-tickets) from #43.

Parent

#43

What to build

The contract step of the wide refactor. With all services migrated (#50, #51, #52) and the api-key logic absorbed behind a shim (#46), repoint the last non-middleware importers (the api-key service's create/rotate controllers and the email onboarding flow) to @reloop/auth/apikey, then delete the @reloop/apikey package entirely. Final green everywhere.

Acceptance criteria

• api-key service (create/rotate) and email onboarding import from @reloop/auth/apikey
• No remaining references to @reloop/apikey anywhere in the repo
• @reloop/apikey package removed (workspace, lockfile, tsconfig references cleaned up)
• Full build + tripwire (Auth refactor 1/10 — Test harness + characterization tripwire #44) + plugin suite (Auth refactor 4/10 — Unified middleware plugin factory + package test suite #47) green across the monorepo

Blocked by

• Auth refactor 3/10 — Absorb the api-key package (expand) #46
• Auth refactor 7/10 — Migrate plain-session services, batch A #50
• Auth refactor 8/10 — Migrate plain-session services, batch B #51
• Auth refactor 9/10 — Migrate the special services (contacts, admin, credits) #52