Auth: correctly attribute child agent run to the parent key

[fabiencelier]

Description

closes https://github.com/dust-tt/tasks/issues/9537

run agent calls originating from API calls were not correctly assigned to the api key.
This fixes the issue by correctly attributing the key in the auth + using the attribution key everywhere

Tested locally: before the fix child run where wrongly billed on no key and the rate limiter was not hit.
After the fix, the billing is done on correct key + rate limiter is used.

Note that attribution key was already added in #26888 but removed in #26933

Tests

• Tested locally: before the fix child run where wrongly billed on no key and the rate limiter was not hit. After the fix, the billing is done on correct key + rate limiter is used.
• Added some small unit tests

Risk

medium, this impact authentication

Deploy Plan

deploy front

[fabiencelier]

r? @tdraier @flvndvd

[github-actions]

	Fails
🚫	Files in front-api/routes/v1/ have been modified. Please add the documentation-ack label to acknowledge that if anything changes in a documented endpoint, you need to edit the JSDoc comment above the handler definition and/or the swagger_schemas.ts file and regenerate the documentation using npm -w front-api run docs

	Warnings
⚠️	front/lib/auth.ts (Authenticator) has been modified and the PR has the sse-ack label. Don't forget to deploy front-sse alongside front.

Generated by 🚫 dangerJS against c4022c9

[github-actions]

cc-verify: violations found!

• one-usage-key-identity: Spend precheck and traces bypass helper

Findings and notifications outside the PR diff:

Source: front-api/routes/v1/w/[wId]/assistant/conversations/index.ts:187

This pre-existing gate violates the new one-usage-key-identity contract on Authenticator.keyForUsageAttribution (front/lib/auth.ts) by still checking auth.key(). When a forwarded originating key is capped but the system key is uncapped, this precheck allows an empty conversation to be persisted before the updated postUserMessage gate rejects its message; use keyForUsageAttribution() here too.

---

Source: front/lib/api/llm/llm.ts:292

This pre-existing trace writer violates the new one-usage-key-identity contract on Authenticator.keyForUsageAttribution (front/lib/auth.ts) by persisting authenticator.key().id alongside the generation’s token usage. For an attributed run_agent sub-agent, Langfuse therefore records the system key while message analytics and spend counters record the originating key; resolve apiKeyId through the new helper.