feat(auth.apikeys): IApiKeyStoreMigrator abstraction — SQLite implements it, DI registers it via TryAdd so a provider registered first wins; ApiKeyAdminCommands accepts the interface (old ctor kept)

Claude-Session: https://claude.ai/code/session_013L3XdmVii9i5sY4FChU8pB

ZB.MOM.WW.Auth/src/ZB.MOM.WW.Auth.Abstractions/ApiKeys/ApiKeyContracts.cs

@@ -78,3 +78,16 @@ public interface IApiKeyAuditStore
     Task AppendAsync(ApiKeyAuditEntry entry, CancellationToken ct);
     Task<IReadOnlyList<ApiKeyAuditEntry>> ListRecentAsync(int limit, CancellationToken ct);
 }
+
+/// <summary>
+/// Creates or upgrades the API-key store schema to the version this build supports. Each store
+/// provider (SQLite, SQL Server) supplies one; hosts run it at startup and before admin commands.
+/// Implementations must be idempotent and safe to run concurrently from several nodes.
+/// </summary>
+public interface IApiKeyStoreMigrator
+{
+    /// <summary>Migrates the store schema.</summary>
+    /// <param name="ct">A token to cancel the operation.</param>
+    /// <returns>A task that completes when the schema is current.</returns>
+    Task MigrateAsync(CancellationToken ct);
+}