Security: Support the Key module for API token storage

Problem/Motivation

API tokens and the secure slug are stored in the myrest.auth_settings configuration object, which means they end up in configuration exports and in version control. Secrets should never be part of exported configuration.

Proposed resolution

• Add optional integration with the key module so tokens can be referenced instead of stored.
• Fall back to the State API when key is not installed.
• Mark the sensitive schema keys appropriately and never render stored token values in the settings form.

Remaining tasks

Implement the key/state backends and migrate existing configuration.

User interface changes

Token fields can point to a key entity; stored values are masked.

API changes

Token resolution goes through a pluggable backend.