feat: edit API keys (name, rights); quick dump text above its buttons; inline note badges

- PATCH /keys/{id} renames a key or changes its scopes; the secret stays. Settings → API gets an
  edit button per key with the same switches as for a new key.
- Quick dump: a multiline text gets the full width, the buttons move to their own row below; the
  bar only goes back to one line once the text is clearly shorter (no flip-flopping).
- Notes: the "Erweitert"/"Unteraufgabe" badges sit right after the checkbox text.

v0.38.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/apikey_access_test.go

@@ -126,3 +126,28 @@ func TestFilterTasks(t *testing.T) {
 		t.Error("unknown status should fail")
 	}
 }
+
+// A key can be renamed and get other rights; the secret stays, other users' keys are out of reach.
+func TestUpdateAPIKey(t *testing.T) {
+	srv, store, token := setupTestServer(t)
+	router := srv.Router()
+	claims, _ := auth.ValidateToken(testJWTSecret, token)
+	key, _ := store.CreateAPIKey(claims.UserID, "Home Assistant", []string{"webhook:triage"})
+
+	rec := sessionCall(router, http.MethodPatch, "/api/v1/keys/"+key.ID, token, `{"name":"Claude Code","scopes":["tasks:read","tasks:write"]}`, "")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("update: %d %s", rec.Code, rec.Body.String())
+	}
+	if code, _ := keyRequest(t, router, key.RawKey, http.MethodGet, "/api/v1/tasks", ""); code != http.StatusOK {
+		t.Fatalf("same secret should now read tasks: %d", code)
+	}
+	keys, _ := store.GetAPIKeys(claims.UserID)
+	if keys[0].Name != "Claude Code" {
+		t.Fatalf("name not changed: %+v", keys[0])
+	}
+	other, _ := store.CreateUser("other@example.com", "hash", "Other", "member")
+	foreign, _ := store.CreateAPIKey(other.ID, "Fremd", nil)
+	if rec := sessionCall(router, http.MethodPatch, "/api/v1/keys/"+foreign.ID, token, `{"name":"x"}`, ""); rec.Code != http.StatusNotFound {
+		t.Fatalf("foreign key must not be changed: %d", rec.Code)
+	}
+}