fix(web): API key settings follow-ups (error handling, CSRF origin check, empty scopes label) #79

Follow-up from the independent review of #77 (scoped publishing keys in Settings). All low severity; none block.

• apps/web/app/routes/api.user-api-keys.ts DELETE with a malformed JSON body returns 500 instead of 400 (POST got the guard).
• apps/web/app/routes/settings.tsx the create dialog closes before the server responds; on 400/403 the user loses the name and selected publishers.
• apps/web/app/components/settings/api-keys-table.tsx a key whose stored scopes parse to [] shows an empty Access cell instead of "No access".
• api.user-api-keys.ts scopes: null returns 400 while docs only describe omitting the field (fails safe; document or accept null as omitted).
• The route has no Origin/CSRF check and relies on the session cookie's default SameSite=Lax; a sibling subdomain could send cookie-bearing requests. Pre-existing; consider an Origin check on mutating auth routes.
• settings.tsx after Done the plaintext key stays in the in-memory action result until the next navigation (not re-shown).
• Separate: the api.skill-favorite client chunk contains the key_hash column name (no data); check that no server-only module is imported client-side there.