feat(api-keys): T24-T27 implement API keys CRUD endpoints

- T24: POST /api/keys with encryption and limit validation
- T25: GET /api/keys with pagination and sorting
- T26: PUT /api/keys/{id} for partial updates
- T27: DELETE /api/keys/{id} with cascade
- Add ownership verification (403 for unauthorized access)
- API key encryption with AES-256 before storage
- Never expose API key value in responses
- 100% coverage on api_keys router (25 tests)

Refs: T24 T25 T26 T27

tests/conftest.py

@@ -48,3 +48,67 @@ def mock_env_vars(monkeypatch):
     monkeypatch.setenv('DATABASE_URL', 'sqlite:///./test.db')
     monkeypatch.setenv('DEBUG', 'true')
     monkeypatch.setenv('LOG_LEVEL', 'DEBUG')
+
+
+@pytest.fixture
+def mock_db():
+    """Create a mock database session for unit tests."""
+    from unittest.mock import MagicMock
+    return MagicMock()
+
+
+@pytest.fixture
+def mock_user():
+    """Create a mock authenticated user for testing."""
+    from unittest.mock import MagicMock
+    user = MagicMock()
+    user.id = 1
+    user.email = "test@example.com"
+    user.is_active = True
+    return user
+
+
+@pytest.fixture
+def mock_encryption_service():
+    """Create a mock encryption service for testing."""
+    from unittest.mock import MagicMock
+    mock = MagicMock()
+    mock.encrypt.return_value = "encrypted_key_value"
+    mock.decrypt.return_value = "sk-or-v1-decrypted"
+    return mock
+
+
+@pytest.fixture
+def client():
+    """Create a test client with fresh database."""
+    from fastapi.testclient import TestClient
+    from sqlalchemy import create_engine
+    from sqlalchemy.orm import sessionmaker
+    from sqlalchemy.pool import StaticPool
+    
+    from openrouter_monitor.database import Base, get_db
+    from openrouter_monitor.main import app
+    
+    # Setup in-memory test database
+    SQLALCHEMY_DATABASE_URL = "sqlite:///:memory:"
+    engine = create_engine(
+        SQLALCHEMY_DATABASE_URL,
+        connect_args={"check_same_thread": False},
+        poolclass=StaticPool,
+    )
+    TestingSessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
+    
+    def override_get_db():
+        """Override get_db dependency for testing."""
+        try:
+            db = TestingSessionLocal()
+            yield db
+        finally:
+            db.close()
+    
+    app.dependency_overrides[get_db] = override_get_db
+    
+    Base.metadata.create_all(bind=engine)
+    with TestClient(app) as c:
+        yield c
+    Base.metadata.drop_all(bind=engine)