fix(api): API key create erases an explicit max_amount of 0 before validation #980

Follow-up to #133. Per the owner's decision there, the API should reject an explicit max_amount: 0.

The #133 fix rejects an explicit 0 in the shared auth adapter (apiPermissionsToPermissions), which covers group writes end to end. The HTTP API-key create handler, however, decodes the request into api.CreateAPIKeyRequest/api.Permission, where max_amount is a plain float64 with omitempty. That erases an explicit 0 before the auth layer sees it, so a key created over HTTP with max_amount: 0 is still stored as "no cap".

Suggested fix: retype api.CreateAPIKeyRequest.Permissions to the auth request type, or share the constraint type, so the explicit-0 detection reaches apiPermissionsToPermissions. Also remove the remaining JSON re-encode for permissions noted in #950. Add an HTTP-level test showing a key create with max_amount: 0 returns 400.

Related: #133, #950, #957.