fix(keyless): correct API-key and tool guidance

Point keyless recovery at an API key instead of OAuth, scope the keyless profile to the tools that session actually has, and fix developer-search copy to match the live data.web shape.