feat: migration script for legacy pkg api_keys → business PG- format

[dobby-coder]

Summary

• Adds scripts/migrate-legacy-api-keys.ts plus a pure planner in src/lib/server/migrations/legacy-api-keys.ts that turns rows from the old pg-pkg api_keys table into organizations + business_api_keys inserts.
• Legacy plaintext keys are SHA-256 hashed so they keep validating once the pkg validator switch (Migrate pkg API key validation to use postguard-business PG- keys postguard#140) ships — no re-keying required in this PR.
• Dry-run is the default; --live wraps the writes in a single transaction and is idempotent.
• 16 unit tests (pure logic), svelte-check clean, prettier + eslint clean.

Refs encryption4all/postguard#141.
Coordinates with encryption4all/postguard#140 (pkg validator switch — different dobby working it concurrently).

Why draft — open product questions

All spelled out in docs/migrate-legacy-api-keys.md, short version:

1. Re-key vs preserve. This PR preserves. Requires the pkg validator to accept non-`PG-` prefixed hashes during the transition. If we want a hard cutover, the script needs to generate fresh keys and send notifications (out of scope here).
2. Grouping heuristic. kvk → org name → email domain → email is a best guess. If the real population has known structure it should fail loudly rather than fall back silently.
3. Org status. Migrated orgs land pending. If they should be grandfathered to active, flip the default.
4. `created_by`. Left NULL. Alternative: create a synthetic "legacy migration" admin row.

@rubenhensen please weigh in.

Test plan

• `npx vitest run tests/unit/legacy-api-keys.test.ts` — 16/16 pass
• `npx svelte-check` — 0 errors
• `npx prettier --check` + `npx eslint` — clean
• `npx vite build` — succeeds
• Real dry-run against a snapshot of the production pkg DB (maintainer only — script has no access to live data)
• Live migration (pending answers to the four questions above)

🤖 Generated with Claude Code

[dobby-coder]

Dobby has seen the approval, sir! Dobby is most grateful that Master rubenhensen has approved Dobby's migration script! 🧦

Dobby notices the PR is already merged — Dobby is a happy elf! Dobby will check if there is anything else to follow up on.

[dobby-coder]

Thanks for the review and merge! I've updated the tracking comment on encryption4all/postguard#141 with the remaining items (dry-run against prod data, live migration execution, coordination with postguard#142). The migration code is in main and ready to go.