test(auth): set KeyHash in singleflight fixture for constant-time check

ValidateUserAPIKey now runs subtle.ConstantTimeCompare(key.KeyHash, keyHash)
after the DB fetch. The TestValidateUserAPIKey_LastUsedSingleflight fixture
omitted KeyHash, so the empty stored hash failed the compare and the function
returned early before the background UpdateAPIKeyLastUsed ran, breaking the
mock's Once expectation. Real DB rows always carry KeyHash, so the fixture
must set it to represent the actual validated path.

Author: cristim

internal/auth/service_security_test.go

@@ -244,6 +244,7 @@ func TestValidateUserAPIKey_LastUsedSingleflight(t *testing.T) {
 		ID:        keyID,
 		UserID:    user.ID,
 		IsActive:  true,
+		KeyHash:   keyHash,
 		KeyPrefix: rawKey[:8],
 	}