[adenarc]

Closes #883

The api-key plugin only has the user-keys and org-keys configs, so any Better Auth apiKey.create/get/update/delete call without a configId threw "No default api-key configuration found". That's what broke Settings → API Keys on feedback.nearbuilders.org.

The plugin won't take a config without a configId when you pass more than one, and adding a third "default" config would make a new kind of key that session lookup (key.configId === "user-keys") and the verify fallback loop don't know about. So this keeps every personal key on user-keys and fills the configId in with a small before hook (apiKeyDefaultConfig) when a call leaves it out:

• create({ name }) → user-keys (api_…)
• create({ name, organizationId }) → org-keys (org_…)
• get / update / delete without configId → user-keys
• Calls that pass a configId are untouched, so existing keys, prefixes and the explicit user-keys/org-keys callers (nearbuilders.org, feedback v2-platform: 13 provider consolidation — one self-hostable alchemy program #287, the org pages) behave the same.
• list() without a configId already returned the caller's personal keys. Tested that existing and new keys both show up and org keys don't.

One thing to note: a bare delete/update on an org key now gets "key not found" instead of the old "no default config" error. Org callers already pass org-keys.

Tested

• New integration tests in plugins/auth/tests/integration/api-keys.test.ts hit /api/auth/api-key/* through auth.handler with a session cookie, the same way a child app's client does: bare create (personal and org), list, get, update, delete. Without the hook the create, list, get and delete tests fail, and with it they pass.
• api-keys, session, auth-context, permissions and credential-less-client integration suites: 47/47 passing locally.
• pnpm run typecheck passes. Biome is clean. oxlint wouldn't load its Effect plugin config locally, so CI covers it.
• Not tested: an end-to-end run from a child app against a local build.

No UI change.