B2B-10 · Read API keys + per-key rate limiting

Part of the B2B epic (Bloco 3 · item 3.1). Today throttling is **global** (`server/app.module.ts:112-115`) and M2M via Ory Hydra (`m2m.guard.ts`) grants the broad `integration` role with `Create` access — there is no read-only key concept.

## What
- [ ] `ApiKey` entity per client org (hashed key, scopes, namespace binding)
- [ ] Key guard (read-only scope) — key must respect namespace isolation
- [ ] Per-key throttling (replace/augment the global throttle)
- [ ] Define scope model (read-only first; narrow the `integration` role usage)

**Effort:** ~2 SP · **Depends on:** B2B-1..4 (isolation), B2B-5 (org to bind the key to)