Bring back the external API keys

Commit 0dbb13f removed the whole feature: the apikeys tab, the /ui/apikeys
routes, requireApiKey, the /api/v1 router, the ApiKey type, the better-sqlite3
dependency and UI_DB_FILE in the CLI and the installer. Only the untracked
awg-ui/API.md survived, so the README went on to claim there was no key-based
API at all.

Restores all of it: ui.db with the api_keys table, awgk_ key generation storing
only the SHA-256 and a display prefix, the JWT-guarded CRUD, and the /api/v1
router mounted before the JWT proxy on /api so the key auth is not swallowed.
The tab comes back as its own folder and the registry picks it up on its own.
UI_DB_FILE points at /etc/amnezia/amneziawg/ui.db, outside the install tree, so
reinstalling keeps the keys; a fresh install moves the old one aside with its
WAL sidecars.

better-sqlite3 takes the slot of jsonwebtoken, which arrived with the MA7
integration and has been unused since 068cab4 removed it.

One defect is not reproduced: the /api/v1 handlers called ctrl() without a
try/catch, and Express 4 does not catch async rejections, so a single request
with awg-ctrl down killed the panel process. They now answer 502 like proxy()
already did.

The API contract is documented in the README rather than linked: .gitignore
excludes every markdown but README.md, so awg-ui/API.md is not in the repo and
the link would break on a clone.

Checked against a running server: login, key create/list/delete, 400 on a bad
label, 401 without a JWT, "API key required" rather than "Unauthorized" on
/api/v1, "Invalid API key" for a deleted key, last_used updating, and all three
/api/v1 routes returning 502 with the process still alive.

install.sh

@@ -48,6 +48,7 @@ PRIV_KEY_FILE="$AMNEZIA_DIR/server_private.key"
 PUB_KEY_FILE="$AWG_DIR/server_public.key"
 AWG_CONF="$AWG_DIR/awg1.conf"
 DB_FILE="$AWG_DIR/users.db"
+UI_DB_FILE="$AWG_DIR/ui.db"   # своя БД awg-ui (API-ключи); вне PROJECT — переживает переустановку
 # Внутренняя авторизация awg-ui → awg-ctrl (Ed25519): приватный → awg-ui, публичный → awg-ctrl.
 INTERNAL_AUTH_PRIV="$AWG_DIR/internal_auth_private.key"
 INTERNAL_AUTH_PUB="$AWG_DIR/internal_auth_public.key"
@@ -658,6 +659,15 @@ else
         mv "$DB_FILE" "$DB_BAK"
         warn "Старая база пользователей сохранена: $DB_BAK"
     fi
+    # ui.db (API-ключи awg-ui) — тоже в бэкап, чтобы awg-ui создал чистую БД.
+    if [[ -f "$UI_DB_FILE" ]]; then
+        UI_DB_BAK="${UI_DB_FILE}.bak-$(date +%Y%m%d-%H%M%S)"
+        mv "$UI_DB_FILE" "$UI_DB_BAK"
+        # WAL-сайдкары удаляем — к новой БД они неприменимы.
+        rm -f "${UI_DB_FILE}-wal" "${UI_DB_FILE}-shm"
+        warn "Старая база API-ключей сохранена: $UI_DB_BAK"
+    fi
+
     PRIV_KEY=$(umask 077 && awg genkey)
     PUB_KEY=$(printf '%s' "$PRIV_KEY" | awg pubkey)