Fix production mock-data gaps: wallet prefetch isolation, overview/API-key types, mock gating

[graceuvala-collab]

Summary

• Prefetch cache TTL and tenant isolation for wallets #705 — src/lib/walletsPrefetchCache.ts now attaches the caller's session bearer token to the prefetch request and keys the in-memory cache entry by that token, so a wallets prefetch started under one session can never be served to a different session that signs in afterward on the same tab/device within the 30s TTL. Previously the prefetch sent no auth header at all and the cache was a single unkeyed module-level entry.
• DashboardOverview must not type against mock OverviewData only #706 / ApiKeysTable revoke must call mux-backend revoke, not mock store #707 / APIKeyModal must show secret once and never re-fetch plaintext #708 — Extracted OverviewData (src/types/overview.ts) and ApiKey/CreatedApiKey (src/types/apiKey.ts) out of src/mock-data/* into their own canonical type modules. DashboardOverview, ApiKeysTable, APIKeyModal, and the useApiKeys/useRevokeApiKey hooks now type against these instead of the mock fixtures, so a real mux-backend response only has to satisfy the real contract. src/mock-data/* re-exports the same types for backward compatibility.
• DashboardOverview must not type against mock OverviewData only #706 / ApiKeysTable revoke must call mux-backend revoke, not mock store #707 — Gated the mock-data fallback in src/app/api/overview/route.ts (GET) and src/app/api/api-keys/route.ts (GET/POST/PATCH) behind isMockFallbackAllowed(), matching the existing /api/wallets and /api/activity pattern. A production deployment with no backend configured now returns 503 backend_unavailable instead of silently listing/creating/revoking against the mock store.
• APIKeyModal must show secret once and never re-fetch plaintext #708 — APIKeyModal's standalone key generator (used only when the caller renders it without an onCreateKey handler, e.g. Storybook) now throws instead of fabricating a secret when isMockFallbackAllowed() is false, so it can't hand out a fake key in a production deployment.
• Updated README.md, docs/frontend-env-vars.md, and src/docs/API_Hooks.md to describe the new production/mock split and type ownership.

Closes #705
Closes #706
Closes #707
Closes #708

⚠️ Warning

This PR is implementation only, per explicit instruction from the requester. No automated test coverage (Vitest or Playwright) was added, even though all four linked issues' acceptance criteria ask for tests that fail if the gap returns. Please add regression tests covering:

• Prefetch cache tenant isolation (different session tokens must not share a cache entry) and the now-attached Authorization header.
• /api/overview and /api/api-keys returning 503 in a production build with no backend configured.
• APIKeyModal's fallback key generator throwing (not fabricating a secret) when mock fallback isn't allowed.

before or while merging this branch.

Test plan

• pnpm test (Vitest)
• pnpm run typecheck
• pnpm run test:e2e (Playwright) for the wallets sidebar-hover prefetch and API keys create/revoke flows
• Manual: NODE_ENV=production with NEXT_PUBLIC_API_URL unset → /api/overview and /api/api-keys (GET/POST/PATCH) return 503 backend_unavailable