refactor(auth): delete @reloop/apikey shim; repoint importers (#53)

[pranavp10]

Summary

Final contract step of the auth middleware consolidation (#43):

• Repoint api-key create/rotate and email onboarding to @reloop/auth/apikey / @reloop/auth/apikey/validate
• Delete the @reloop/apikey package entirely
• Remove workspace deps, lockfile entry, and packages/tsconfig path alias
• Characterization tripwire + @reloop/auth package suite remain green

Stacked on #61 (#52). Closes #53.
With this, the full #43 rollout stack is ready to merge bottom-up.

Test plan

• Zero remaining @reloop/apikey references in the repo
• bun run test in apps/backend/auth (6 pass)
• bun test in packages/auth (33 pass)
• Typecheck be-api-key and be-email
• CI green once stack base merges

Greptile Summary

This PR removes the old API key shim and points callers at the auth package directly. The main changes are:

• Deleted the @reloop/apikey workspace package.
• Repointed API key creation and rotation imports to @reloop/auth/apikey.
• Repointed API key validation imports to @reloop/auth/apikey/validate.
• Updated workspace dependencies, the lockfile, and the old tsconfig alias.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.
• The deleted shim only re-exported the same auth package symbols now imported directly.
• The email app now declares the direct auth package dependency it needs.

Important Files Changed

Filename	Overview
apps/backend/api-key/src/routes/api-key/create-api-key/create-api-key.controllers.ts	Repoints API key helper imports to @reloop/auth/apikey.
apps/backend/api-key/src/routes/api-key/rotate-api-key/rotate-api-key.controllers.ts	Repoints key generation and hashing imports to @reloop/auth/apikey.
apps/backend/auth/test/validate-api-key.test.ts	Splits the old shim import into the canonical helper and validation subpath imports.
apps/backend/email/src/routes/onboarding/onboarding.route.ts	Repoints onboarding API key validation to @reloop/auth/apikey/validate.
apps/backend/email/package.json	Adds the direct @reloop/auth dependency required by the new email import.
packages/apikey/src/index.ts	Deletes the pure re-export shim after importers were repointed.
packages/tsconfig/nextjs.json	Removes the obsolete @reloop/apikey path alias.
bun.lock	Removes the deleted workspace package entries and records the new direct auth dependency.

_{Reviews (1): Last reviewed commit: "refactor(auth): delete @reloop/apikey sh..." | Re-trigger Greptile}

[pranavp10]

LGTM