Deactivated or expired EnvironmentAPIKeys still authenticate against SDK endpoints

## Behaviour

`EnvironmentAPIKey.active` and `expires_at` are not checked when resolving `X-Environment-Key` on SDK endpoints served by Core (e.g. `GET /api/v1/environment-document/`, `GET /api/v1/flags/`). A deactivated or expired server-side key continues to authenticate until its row is deleted.

## Code path

- `EnvironmentKeyAuthentication.authenticate` (`api/environments/authentication.py`) resolves the key via `Environment.get_from_cache(api_key)` with no validity check.
- `Environment.get_from_cache` filters `api_keys__key=api_key` only (`api/environments/models.py:304`) — no filter on `active` or `expires_at`.
- `EnvironmentAPIKey.is_valid` exists (`api/environments/models.py:737-739`) but is not consulted on this path.

## Inconsistency with the Edge API

The hosted Edge API does enforce validity: `EnvironmentService.get_client_api_key_from_server_api_key` (edge-api `src/environment.py`) checks `is_valid`, so the same deactivated key gets 401 on Edge but keeps working against Core.

## Impact

Deactivating a server-side SDK key in the dashboard does not stop it from fetching the environment document or flags from Core. This affects local-evaluation SDKs and the Edge Proxy pointed at self-hosted/private-cloud installs.

Found by code reading while researching Edge Proxy auto-discovery (Flagsmith/edge-proxy#128); not yet reproduced against a live instance.

Start with EnvironmentKeyAuthentication.authenticate in api/environments/authentication.py and Environment.get_from_cache in api/environments/models.py, then inspect EnvironmentAPIKey.is_valid at lines 737-739. Verify SDK endpoints reject deactivated and expired keys while valid keys continue to authenticate, matching the Edge API behavior described in the issue.

Written by the indexing model from the issue text.