Adopt withTeamContext in 4 app-layer sites (2 api-keys routes, NextAuth adapter, server actions)

feature_id: FEAT-studio-qa

## Context

Adopt `withTeamContext` (OPER-110) in the 4 remaining app-layer sites that touch the sensitive-subset (from the OPER-104 audit): the 2 api-keys routes, the NextAuth adapter, and the team-scoped server-action bundle. Companion to OPER-113 (which enables RLS on the DB layer). Ratified: OPER-104 PDT Option C.

Every raw Prisma read from these sites must run inside `withTeamContext(teamId, tx => tx.foo.findMany(...))`. The ESLint rule from OPER-110 will fail CI if any is missed.

## Acceptance Criteria

- All 4 files wrap raw Prisma calls in `withTeamContext` or use `getScopedDb`. No bare `prisma.<model>.<op>()` inside `POST`/`PATCH`/`DELETE` handlers.
- Existing tests continue to pass.
- `operant/require-team-context-in-route` ESLint rule reports zero violations across `apps/web/src/app/api/`.
- Server actions in `[team]/actions.ts` receive `teamId` from the route param and pass it to `withTeamContext` (no re-derivation from session).
- Manual smoke: create/rotate an API key as team A; team B cannot see it. Documented in PR body.