Add PdfApiKey model and key storage helpers

Adds a Prisma model for per-student Clean PDF API keys plus a
hand-written migration (no local Postgres to run `migrate dev`
against). getOrCreatePdfKey/regenerateKey wrap the model with
lazy-creation and rotation logic on top of generatePdfKey().

src/lib/clean-pdf/keys.ts

@@ -0,0 +1,23 @@
+import { prisma } from "@/lib/prisma";
+import { generatePdfKey } from "@/lib/clean-pdf/api-key";
+
+export async function getOrCreatePdfKey(userId: string): Promise<string> {
+  const existing = await prisma.pdfApiKey.findUnique({ where: { userId } });
+  if (existing) return existing.key;
+  const created = await prisma.pdfApiKey.upsert({
+    where: { userId },
+    create: { userId, key: generatePdfKey() },
+    update: {},
+  });
+  return created.key;
+}
+
+export async function regenerateKey(userId: string): Promise<string> {
+  const key = generatePdfKey();
+  await prisma.pdfApiKey.upsert({
+    where: { userId },
+    create: { userId, key },
+    update: { key },
+  });
+  return key;
+}