feat: replace SQLAdmin with Keycloak-protected API management page

- Disable SQLAdmin basic auth (comment out mount_admin, statics, redirect)
- Add /api-management page (Keycloak admin role required)
- Add admin_api_keys.py: REST endpoints for list/create clients and keys
- Add api_management.html: manage API clients, keys, permissions with copy-once key display
- Update index.html: API Management link -> /api-management
- Update auth middleware: add /api-management and /admin/users to PROTECTED_PATHS
- Add CHANGES-2026-06-04.md dev notes

03-apiservice/app/templates/index.html

@@ -275,6 +275,15 @@
                 <p>Manage users and roles (Admin only)</p>
             </a>
             {% endif %}
+
+            <!-- API Management (Admin only) -->
+            {% if user and user.roles and 'admin' in user.roles %}
+            <a href="{{ root_path }}/api-management" class="menu-card card-admin">
+                <span class="icon">🔑</span>
+                <h3>API Management</h3>
+                <p>Manage API clients and keys (Admin only)</p>
+            </a>
+            {% endif %}
         </div>
     </div>