fix: redirect loop on stale cookie, login broken for 64-char keys, stale docs

- /dashboard now validates key before redirecting to /home — bad/old keys
  clear the cookie and show login instead of looping
- Login form: remove old 4-group auto-formatter, fix maxlength 19→64,
  fix min length validation 19→10, update placeholder
- New key display: break-all so 64-char hex wraps properly
- docs.html: update example key format and description

apps/web/src/dashboard/docs.html

@@ -103,9 +103,9 @@
         <p>All API requests require an account key passed as a Bearer token:</p>
         <div class="cb">
           <div class="cb-header"><span class="cb-lang">http</span></div>
-          <pre>Authorization: Bearer XXXX-XXXX-XXXX-XXXX</pre>
+          <pre>Authorization: Bearer &lt;your-64-char-hex-key&gt;</pre>
         </div>
-        <p>Create an account at <a href="/dashboard">/dashboard</a> or via the API. Keys are 16-character hex strings formatted as four groups.</p>
+        <p>Create an account at <a href="/dashboard">/dashboard</a> or via the API. Keys are 64-character hex strings (256-bit). Shown once at registration &#8212; store them securely.</p>
       </div>
 
       <!-- Account -->
@@ -121,7 +121,7 @@
         </div>
         <div class="cb">
           <div class="cb-header"><span class="cb-lang">json — response</span></div>
-          <pre>{ <span class="k">"key"</span>: <span class="s">"B8AE-9621-A963-F652"</span>, <span class="k">"email_registered"</span>: <span class="n">true</span> }</pre>
+          <pre>{ <span class="k">"key"</span>: <span class="s">"5bf5311b56d09254c8a1f0e3..."</span>, <span class="k">"email_registered"</span>: <span class="n">true</span> }</pre>
         </div>
 
         <h3>Update Email</h3>