bug: API key creation rejects selected "today" expiry due local-date to UTC conversion

**Describe the bug**
Creating an API key can fail with `INVALID_DATE` even when the user selects a valid date from the date input.

The frontend currently sends expiry as:

- `new Date(newKeyExpiry).toISOString()`

where `newKeyExpiry` is in `yyyy-MM-dd` format.

This converts a local-date selection into a UTC timestamp at midnight (`00:00:00.000Z`). Depending on current time and timezone, a user-selected "today" date can become `<= timezone.now()` on the backend and be rejected.

**To Reproduce**
Steps to reproduce the behavior:

1. Open API keys settings page.
2. Create a new key.
3. Select today's date in the expiry field.
4. Submit at a time where `today 00:00:00Z` is already in the past for server-side comparison.
5. Observe failure with `INVALID_DATE` / `Expiry date must be in future`.

**Expected behavior**
If a user selects a date via date input, the API should interpret that date consistently (for example, end-of-day in UTC or explicit local-date semantics) and not reject valid user intent due to timezone conversion artifacts.

**Are you going to work on fixing this?**

- [x] Yes
- [ ] No

**Screenshots**
If applicable, add screenshots to help explain your problem.

**Desktop (please complete the following information):**

- OS: [e.g. Windows 11]
- Browser: [e.g. Chrome]
- Version: [e.g. 123]

**Smartphone (please complete the following information):**

- Device: [e.g. iPhone 13]
- OS: [e.g. iOS 17]
- Browser: [e.g. Safari]
- Version: [e.g. 17]

**Additional context**
Impact:
Users can see confusing validation failures (`Expiry date must be in future`) for dates they just selected in the UI. This is timezone-dependent and can be intermittent, which makes it harder to understand.

Code references:
- Frontend conversion: `frontend/src/app/settings/api-keys/page.tsx` (`expiresAt: new Date(newKeyExpiry).toISOString()`)
- Backend validation: `backend/apps/api/internal/mutations/api_key.py` (`if expires_at <= timezone.now(): ... INVALID_DATE`)

Suggested direction:
- Use explicit date semantics between frontend and backend.
- Example approaches: send end-of-day timestamp for selected date, or treat date-only values as date boundaries server-side before comparison.
- Keep FE and BE rules aligned for deterministic behavior across timezones.