fix: return 404 instead of 403 for unauthorized key access to prevent ID oracle (CWE-204)

GET /api/v1/keys/:id previously returned distinct HTTP status
codes for 'key not found' (404) vs 'key exists but belongs to
another user' (403). This oracle allowed attackers to enumerate
valid API key IDs by observing response differences.

Now returns 404 in both cases so the response is identical
regardless of whether a key exists.

Fixes: CWE-204 (Information Disclosure via ID Oracle)

backend/internal/handler/api_key_handler.go

@@ -131,7 +131,7 @@ func (h *APIKeyHandler) GetByID(c *gin.Context) {
 
 	// 验证所有权
 	if key.UserID != subject.UserID {
-		response.Forbidden(c, "Not authorized to access this key")
+		response.NotFound(c, "API key not found")
 		return
 	}