fix(usage): avoid API key stats collisions

[codeasier]

Summary

• use a SHA-256 fingerprint as the internal byApiKey aggregation identity instead of the masked API key
• keep usage stats responses secret-safe with apiKeyMasked while preventing same-prefix key collisions
• add regression coverage for 24h/today stats with colliding masked API key prefixes

Closes #2206

Tests

• NODE_PATH=/tmp/node_modules /tmp/node_modules/.bin/vitest run --reporter=verbose --config ./tests/vitest.config.js tests/unit/db-sqlite-vs-lowdb.test.js tests/unit/security-audit.test.js
• git diff --check