fix(api-keys): add write lock to verify_key; resolve path via __file__

feat(rbac):API key management and role-based access control