fix(usage): key live byApiKey stats by full api key to prevent team-key collision

maskApiKey kept only the first 8 characters of the key. API keys minted
from the same machine id share that prefix, so every key of an instance
collapsed into one sk-XXXXXXX*** bucket per model/provider, and the
dashboard attributed one holder's usage to another.

Key the live path by the full api key - matching the daily rollup
(aggregateEntryToDay) and the lastUsed overlay - and keep the last 4
characters in maskApiKey so masked keys stay distinguishable in the UI.