feat: show last-used timestamp on API keys settings page

[benthecarman]

Summary

Track when each user API key last authenticated a request and show it in the Research Settings → API & credits → API keys page.

• user_api_keys.last_used_at (nullable) via migration 2026-10-10-000000_user_api_keys_last_used_at
• Usage recorded in validate_openai_auth after successful API-key auth: throttled conditional update (max one write/minute/key), best-effort so auth never fails if the write errors
• last_used_at added to create/list API key responses and to ApiKey types in both SDKs (#[serde(default)] keeps newer SDKs compatible with older backends)
• Key rows now show Last used <date> (clock icon) or Never used

Screenshot

Rendered from the real component with mocked SDK data; shows fresh, stale, and never-used states.

Validation

• Backend cargo check + cargo test --bins on pinned 1.91.1: 787 passed / 0 failed / 31 ignored (DB-required); cargo fmt; security-invariant tests pass
• Rust SDK cargo check; TS SDK prettier + tests (9 pre-existing live-backend failures, identical on unmodified tree)
• Research frontend typecheck / lint / prettier / tests (1287 pass) / just install frozen install

Reviewer notes

• Run just diesel-migration-run-local and smoke last_used_at through a real API-key request (just desktop-dev); throttle granularity is 1 minute — tunable
• SDK dependency is local source (file:../../../sdk) during development per the consumer version policy; publish @mapleai/sdk and re-pin before release

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[AnthonyRonning]

Hey Ben, thank you for this! It's a genuinely useful feature, and the "Last used" / "Never used" rows look great. The writeup and validation notes made it easy to review, too.

Working through it made us realize we want "last used" to be the first piece of something bigger: per-key spend tracking and, eventually, budgets users can set on each key. To get there, we'd like the billing server to own per-key usage. The key would still live in the enclave, and only a non-secret key ID would cross over, rather than OpenSecret writing a timestamp during auth. So we're going to take a different approach and close this one.

I've written up the direction in two issues, and your PR is credited as where it started:

• API keys: show when each key was last used #1138: show when each key was last used (billing-owned usage, keyed by a new non-secret key ID)
• API keys: per-key spend tracking and user-set budgets #1139: per-key spend tracking and user-set budgets (future)

Your UI work carries straight over to #1138. If you'd like to pick up any part of it, you'd be very welcome. Thanks again for kicking this off!

---

Generated by Claude Code