max / makenotwork

Give the SyncKit keys endpoints their own credential /api/sync/keys/{claim,release,list} authenticated on the app's api_key alone. That value is compiled into every shipped client with include_str!, so it ships inside each binary and comes back out with `strings` -- anyone holding an AppImage or dmg could consume the app's key cap under per_key billing and pollute claim attribution under the app's identity. Split the two roles. api_key stays what it is, a public client identifier. The keys endpoints take an app_secret instead: generated from the dashboard, shown once, stored SHA-256 hashed, and meant only for a developer backend. No backfill and no fallback. An app that has not generated a secret cannot call those three routes at all; deriving one from the api_key would carry the same weakness forward. Nothing first-party calls them today. The dashboard action is a typed dispatcher module rather than another window.* global, per the frontend_globals ratchet.