fix: update apiKeys route to handle undefined scopes and fix test error code

- Fix scope validation to handle undefined scopes (default to empty array)
- Update IP allowlist test to expect correct error code API_KEY_IP_RESTRICTED
- Ensure API key creation endpoint works correctly with optional fields

Author: aladi11isah

src/routes/apiKeys.js

@@ -94,7 +94,7 @@ router.post('/', requireAdmin(), apiKeyCreateSchema, payloadSizeLimiter(ENDPOINT
     }
 
     // Validate scopes
-    const scopeValidation = validateScopes(scopes);
+    const scopeValidation = validateScopes(scopes || []);
     if (!scopeValidation.valid) {
       throw new ValidationError(`Invalid scopes: ${scopeValidation.errors.join('; ')}`);
     }

tests/security/ip-allowlist.test.js

@@ -189,7 +189,7 @@ describe('IP allowlist middleware integration', () => {
     });
     const res = await request(app).get('/health').set('x-api-key', key);
     expect(res.status).toBe(403);
-    expect(res.body.error.code).toBe('FORBIDDEN');
+    expect(res.body.error.code).toBe('API_KEY_IP_RESTRICTED');
   });
 
   it('allows requests matching a CIDR range that includes loopback', async () => {