fix: Move the API keys page off the /api prefix

/api-keys shares a raw string prefix with /api, and the proxies in front
of this app do not all match by path segment. Nginx Proxy Manager routes
/api straight to the Go server with a prefix location, so /api-keys never
reached Next at all — it reached a control plane with no such route and
came back as a JSON 404. Traefik's PathPrefix has the same shape of
matcher, which puts the Helm ingress at risk whenever ingress.api.enabled
is on.

The page is /tokens now, which cannot collide with anything, and which
matches the /api/tokens the REST API already publishes. The sidebar still
says API Keys — the label is for the reader, the path is for the router.

A permanent redirect covers anyone who bookmarked the old path today.
Fixing the proxy config instead would have left the trap set for the next
deployment, and for whatever sits in front of it.

CLAUDE.md

@@ -467,7 +467,7 @@ window, answering 429 with `Retry-After`; cookie sessions are untouched; it
 exists so a runaway script cannot take an instance down, not as the general
 API rate-limiting project some future ticket might build.
 
-**The UI calls them API keys and lives at `/api-keys`, not on `/settings`.**
+**The UI calls them API keys and lives at `/tokens`, not on `/settings`.**
 The page is reachable at **every** role, which is the whole reason it is a page:
 `/settings` is owner|admin throughout, so a card there hid a capability every
 member has. `settings.api_token_max_days` stays on `/settings` because it is
@@ -1022,7 +1022,7 @@ Customer nav is three destinations — Overview, People, Billing. Settings is in
 | `/steps`                                                        | Reusable step library                                                   |
 | `/monitors`, `/monitors/new`, `/monitors/[id][/edit]`           | Checks, uptime, incidents                                               |
 | `/secrets`, `/secrets/[group]`                                  | Vault                                                                   |
-| `/api-keys`                                                     | Personal API keys — reachable at **every** role, unlike `/settings`     |
+| `/tokens`                                                       | Personal API keys — reachable at **every** role, unlike `/settings`     |
 | `/audit`                                                        | Audit log                                                               |
 | `/settings`, `/settings/notifications`, `/settings/license`     | Members, OIDC, alerts, retention, ESO token · channels · licence        |