Migration checklist: API key to OAuth

Highlights

• Map legacy permissions to OAuth scopes.
• Enable dual-mode auth during transition.
• Sunset old keys in staged waves.

Tags: #oauth #migration #auth