583a140485
SHA-256 hashed keys, fmcp_ prefix, soft-delete revocation. Tests cover pure logic (hash, prefix, format, uniqueness, scope validation) and auth middleware bearer token path (pending auth.py update). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>