Add durable control-plane state storage

[jynbil1]

Summary

• add a Mongo-backed control-plane store for single-use OAuth/MCP tokens, admin sessions, and shared rate-limit counters
• extend API keys with scopes, expiry, org/project bindings, and production fail-fast behavior for durable storage
• wire auth/admin/rate-limit paths to durable state and add focused regression coverage

Verification

• uv run --extra dev python -m pytest tests/unit/test_control_plane_store.py tests/unit/test_database_stores.py tests/api/test_dependencies_and_routes.py
• uv run --extra dev ruff check src/database/control_plane_store.py src/database/api_key_store.py src/api/dependencies.py src/api/routes/auth.py src/api/routes/admin.py src/api/routes/api_keys.py tests/unit/test_control_plane_store.py tests/unit/test_database_stores.py tests/api/test_dependencies_and_routes.py

/claim #161

[gemini-code-assist]

Code Review

This pull request introduces a ControlPlaneStore to manage short-lived state such as admin sessions, OAuth tokens, and rate limits using MongoDB, replacing several in-memory implementations. API keys are enhanced with support for scopes, expiration, and organization/project bindings, including validation logic in the request dependencies. The update also enforces durable storage requirements for production environments and includes comprehensive unit tests for the new functionality. I have no feedback to provide.