#963 POST /admin/api-keys ignores documented expires_in_days; key never expires

EARS: When POST /api/v1/admin/api-keys receives expires_in_days, the API shall set expires_at = now + expires_in_days; if both expires_in_days and expires_at are given, then it shall return 422. Found 2026-10-17: ApiKeyCreateRequest (api/openapi/models/auth.py:324) documents expires_in_days, handler api/blueprints/v1/api_keys.py reads only expires_at; key cb829e72 created with expires_in_days=1 had expires_at null (revoked). Also: key names are unique including deactivated keys (409), undocumented.