feat: prepare external API persistence foundation

[bballdavis]

Summary

• prepares API-key policy, explicit channel grants, durable external requests, quota accounting, and supporting catalog indexes
• preserves existing keys as legacy_download and leaves current key creation, hashing, one-time reveal, validation, usage tracking, deletion, and single-video behavior unchanged
• establishes canonical channel identity while refusing to merge duplicate rows with conflicting persisted state
• documents only the inactive schema and compatibility behavior delivered in phase one

Part of #568.

Scope boundaries

This phase exposes no external routes, authentication middleware, request execution, management endpoints, rate-limit enforcement, feature flags, Swagger contract, or frontend UI.

Migration safety

• existing keys backfill to legacy_download
• partial permission migrations recover without overwriting established values
• conflicting duplicate channel rows abort and preserve rows and references
• byte-equivalent duplicates remap references before consolidation
• rollback deactivates external-role keys fail-closed

Validation

• affected migration, model, legacy API-key, and download regression suites: 237/237 passed
• complete backend suite: 139/139 suites and 3,911/3,911 tests passed with 88.11% line coverage
• repository pre-commit suite: ESLint, TypeScript, 223/223 frontend suites (4,333 tests), and 139/139 backend suites (3,911 tests) passed
• MariaDB 10.3 phase-migration safety matrix passed, including backfill, rerun, rollback/reapply, duplicate consolidation, reference preservation, and fail-closed rollback
• production client build and Storybook static build passed
• Storybook interaction parity: 21/21 passed
• production dependency audit passes the configured high-severity threshold; three moderate uuid findings remain and require breaking dependency upgrades
• hosted CI passes Backend, Security Audit, ESLint/TypeScript, Frontend, Storybook, auto-review, and the aggregate All Checks gate

Upstream baseline note

• a fresh full migration run reaches the existing JobVideoDownloads foreign-key mismatch before these phase-one migrations; the phase-specific real-database matrix passes