Delete API key

Supabase session JWT from a signed-in browser session, supplied as Authorization: Bearer <jwt>. This is what the web app sends. It shares the Authorization header with bearerApiKey; the server distinguishes them by the ela_ prefix on API keys.