fix: redirect loop on stale cookie, login broken for 64-char keys, stale docs

- /dashboard now validates key before redirecting to /home — bad/old keys
  clear the cookie and show login instead of looping
- Login form: remove old 4-group auto-formatter, fix maxlength 19→64,
  fix min length validation 19→10, update placeholder
- New key display: break-all so 64-char hex wraps properly
- docs.html: update example key format and description

apps/web/src/routes/dashboard.ts

@@ -80,8 +80,14 @@ export const dashboard = new Elysia()
   .get("/dashboard/query-builder.js", () => Bun.file(`${dashDir}/query-builder.js`))
 
   // Login page
-  .get("/dashboard", ({ cookie }) => {
-    if (cookie?.pingql_key?.value) return redirect("/dashboard/home");
+  .get("/dashboard", async ({ cookie }) => {
+    const key = cookie?.pingql_key?.value;
+    if (key) {
+      const resolved = await resolveKey(key);
+      if (resolved) return redirect("/dashboard/home");
+      // Invalid/stale key — clear it and show login
+      cookie.pingql_key?.remove();
+    }
     return Bun.file(`${dashDir}/index.html`);
   })