* feat: add backend api-key auth context and settings hardening * fix: harden api key token hashing
The note is not visible to the blocked user.