fix: remove api keys from principal context

[rpatel-scale]

Summary

• Remove API-key fields from auth gateway principal contexts before assigning request.state.principal_context.
• Sanitize cached auth gateway principals before write and read, so cached values cannot reintroduce api_key.
• Add focused unit coverage for recursive key removal and sanitized auth gateway/cache behavior.

Validation

• uv run --project agentex ruff check agentex/src/api/schemas/principal_context.py agentex/src/api/middleware_utils.py agentex/src/api/authentication_middleware.py agentex/src/api/authentication_cache.py agentex/tests/unit/api/test_principal_context.py agentex/tests/unit/api/test_authentication_cache_metrics.py
• uv run --project agentex --group test pytest agentex/tests/unit/api/test_principal_context.py agentex/tests/unit/api/test_authentication_cache_metrics.py
• git diff --check