fix: enforce hosted api-key controls and audit sanitization

[sammargolis]

Summary

• enforces hosted-mode restrictions on user-managed API key persistence
• removes hosted analytics injection in web layout path
• expands server audit sanitization coverage and tests
• fixes API-key route encryption/decryption typing for strict TS compatibility

Security impact

• prevents hosted server-side local filesystem key-management path by default
• standardizes sanitized server-side logging on sensitive routes

PHI handling impact

• strengthens non-PHI audit logging guarantees
• ensures guarded logging checks remain enforced

Tests executed

• pnpm build:test
• pnpm exec tsc --project apps/web/tsconfig.json --noEmit
• pnpm test:no-phi-logs

Rollback plan

• revert this PR to return prior API key and audit logging behavior