WS8 PR B: review round 2 - inert personal keys under policy-off

Address independent review (approve-with-fixes):

1. Pre-existing personal keys under a keys-off firm policy are now honestly
   inert, not silently active:
   a. requireMemberPolicy gains an optional shouldGate(req) predicate; on
      PUT /user/api-keys/:provider only a real (non-empty) SAVE is gated -
      a null/empty api_key (removal) always passes, so members can always
      remove their own keys.
   b. getUserApiKeys / getUserApiKeyStatus resolve org id + allow_member_api_keys
      in ONE query (getUserOrganisationKeyContext, reused from the firm-key
      layer - no second lookup); policy-off SKIPS the personal-key layer
      (firm > env; status source never "user"). Fail-open preserved: on a
      lookup error the personal key still applies. Saved-but-unused keys are
      reported via ApiKeyStatus.inertPersonalKeys.
   Frontend: the "managed by your firm" api-keys card lists any lingering
   personal key with a Remove action + copy, MFA-guarded, reloadProfile on
   success; inertPersonalKeys threads through UserProfileContext.

2. Comment at GET /mcp-connectors/oauth/callback noting it is transitively
   protected by the gated oauth/start.

3. Corrected the account/layout.tsx default-permissive comment to state the
   real tradeoff.

Tests: backend 224 pass (userApiKeys policy-off resolution + inert reporting +
fail-open; auth.policy save-only gate). Frontend tsc + eslint clean on changed
files.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>