No read API (the 'read' key permission is minted but never validated)

Severity: High (parity blocker) · Where: api-keys.ts:308; authz.ts:63-89 The read API-key permission is minted but handleValidateApiKey is only ever called with error-tracking; stats endpoints are session-cookie-only. No programmatic read access. Fix: Validate the read permission on stats endpoints (Bearer key) alongside session auth.