Dashboard: delete revoked API keys + confirm Rotate/Revoke/Delete

Add IApiKeyAdminStore.DeleteAsync that only deletes already-revoked
rows (active keys must be revoked first so the revoke event lands in
the audit log before the row disappears) and a matching admin-gated
DashboardApiKeyManagementService.DeleteAsync. ApiKeysPage now shows
Delete on revoked rows in place of the old "No actions" stub, and
Rotate/Revoke/Delete all route through ConfirmDialog so each
destructive action requires an explicit confirmation step.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/ZB.MOM.WW.MxGateway.Server/Security/Authentication/IApiKeyAdminStore.cs

@@ -39,4 +39,15 @@ public interface IApiKeyAdminStore
         byte[] secretHash,
         DateTimeOffset rotatedUtc,
         CancellationToken cancellationToken);
+
+    /// <summary>
+    /// Permanently deletes an API key, but only if it is already revoked. Active keys are
+    /// untouched (returns false) so an admin cannot delete a working credential without
+    /// first revoking it — that preserves the audit trail and forces the revoke event to
+    /// land in the audit log before the row disappears.
+    /// </summary>
+    /// <param name="keyId">Key identifier.</param>
+    /// <param name="cancellationToken">Cancellation token.</param>
+    /// <returns>True if a revoked key was deleted; false if the key is missing or active.</returns>
+    Task<bool> DeleteAsync(string keyId, CancellationToken cancellationToken);
 }

src/ZB.MOM.WW.MxGateway.Server/Security/Authentication/SqliteApiKeyAdminStore.cs

@@ -109,6 +109,23 @@ public sealed class SqliteApiKeyAdminStore(AuthSqliteConnectionFactory connectio
         return rows > 0;
     }
 
+    /// <inheritdoc />
+    public async Task<bool> DeleteAsync(string keyId, CancellationToken cancellationToken)
+    {
+        await using SqliteConnection connection = await connectionFactory.OpenConnectionAsync(cancellationToken).ConfigureAwait(false);
+
+        await using SqliteCommand command = connection.CreateCommand();
+        command.CommandText = """
+            DELETE FROM api_keys
+            WHERE key_id = $key_id AND revoked_utc IS NOT NULL;
+            """;
+        command.Parameters.AddWithValue("$key_id", keyId);
+
+        int rows = await command.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
+
+        return rows > 0;
+    }
+
     private static void AddCreateParameters(SqliteCommand command, ApiKeyCreateRequest request)
     {
         command.Parameters.AddWithValue("$key_id", request.KeyId);