feat: edit API keys (name, rights); quick dump text above its buttons; inline note badges

- PATCH /keys/{id} renames a key or changes its scopes; the secret stays. Settings → API gets an
  edit button per key with the same switches as for a new key.
- Quick dump: a multiline text gets the full width, the buttons move to their own row below; the
  bar only goes back to one line once the text is clearly shorter (no flip-flopping).
- Notes: the "Erweitert"/"Unteraufgabe" badges sit right after the checkbox text.

v0.38.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/storage/apikeys.go

@@ -93,6 +93,42 @@ func (s *Store) GetAPIKeys(userID string) ([]domain.APIKey, error) {
 	return keys, nil
 }
 
+// UpdateAPIKey changes name and/or rights of an own key; the secret itself never changes. nil keeps
+// a value. Returns ErrAPIKeyNotFound for keys of other users.
+func (s *Store) UpdateAPIKey(userID, keyID string, name *string, scopes *[]string) (*domain.APIKey, error) {
+	if name != nil {
+		n := strings.TrimSpace(*name)
+		if n == "" {
+			return nil, errors.New("Der Name darf nicht leer sein")
+		}
+		if res, err := s.db.Exec(`UPDATE api_keys SET name = ? WHERE id = ? AND user_id = ?`, n, keyID, userID); err != nil {
+			return nil, err
+		} else if c, _ := res.RowsAffected(); c == 0 {
+			return nil, ErrAPIKeyNotFound
+		}
+	}
+	if scopes != nil {
+		joined := strings.Join(NormalizeScopes(*scopes), ",")
+		if res, err := s.db.Exec(`UPDATE api_keys SET scopes = ? WHERE id = ? AND user_id = ?`, joined, keyID, userID); err != nil {
+			return nil, err
+		} else if c, _ := res.RowsAffected(); c == 0 {
+			return nil, ErrAPIKeyNotFound
+		}
+	}
+	keys, err := s.GetAPIKeys(userID)
+	if err != nil {
+		return nil, err
+	}
+	for i := range keys {
+		if keys[i].ID == keyID {
+			return &keys[i], nil
+		}
+	}
+	return nil, ErrAPIKeyNotFound
+}
+
+var ErrAPIKeyNotFound = errors.New("API-Schlüssel nicht gefunden")
+
 func (s *Store) DeleteAPIKey(userID, keyID string) error {
 	_, err := s.db.Exec(`DELETE FROM api_keys WHERE id = ? AND user_id = ?`, keyID, userID)
 	return err