feat(api-keys): scope provider grants by region

[caigee-cmd]

Summary

• allow named API keys to grant provider families or specific provider regions
• enforce provider+region authorization through routing, pinning, failover, and /v1/models
• preserve legacy family grants and make the key editor descriptor-driven
• show model names and remaining time for model-scoped cooldowns

Validation

• make check
• cd frontend && npm run sync

Generated frontend bundles are included.