- Inject OperationsLogger $ops into regenerate() via Laravel IoC
- Record api_key.regenerated event with payloadAfter={key_prefix} — plain key never logged
- New Pest test: ApiKeyRegenerateAuditTest (RED→GREEN verified, 8 assertions)
- Existing ApiKeyControllerTest: 7/7 pass (no regression)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>