fix(auth): use API key owner for authenticated subject to prevent admin spoofing

[Micsi]

Motivation

• Prevent privilege escalation where API-key authentication returned api_keys.name as the subject, allowing a non-admin to create a key named admin and bypass get_admin_user to reach admin-only endpoints such as /api/v1/config/export/db.

Description

• In obs/api/auth.py get_current_user now queries SELECT owner FROM api_keys WHERE key_hash=? and returns row["owner"] instead of returning the user-controlled name, ensuring the authenticated principal is the real key owner.

Testing

• Attempted pytest -q tests -k "auth or api_key or config", but test collection failed in this environment because pytest_asyncio is not installed, so automated validation could not be completed here.

---

Codex Task