Audit and ensure API keys are only stored in worker_oauth

[MoralCode]

breakout issue for this portion of worker platform/key handling improvements:

key storage:

I generally agree with #71 on this last point. worker_oauth needs to be the only place we store API keys.

Originally posted by @MoralCode in #293

essentially We should audit to make sure we arent storing API keys in any tables besides worker_oauth