perf(db): index case-insensitive api key lookups

[raymondjacobson]

Summary

• add a concurrent functional index on lower(api_key)
• preserves existing case-insensitive rate-limit lookup semantics while making the predicate indexable

Production evidence

• pg_stat_statements showed the rate-limit lookup at ~23.7M calls
• pg_stat_user_tables showed api_keys had ~23.7M seq scans and ~35B tuples read
• EXPLAIN for LOWER(api_key) = LOWER() used a seq scan, while exact api_key lookup uses the pkey
• production has 335 mixed-case api_keys, so a code-only exact lookup would change behavior

Verification

• migration follows existing CONCURRENTLY migration style