### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### The Feature

Add an `allowed_tags` field to virtual keys that enforces tag-based deployment routing at the key level, independently of what tags the caller sends in the request body.

When `allowed_tags` is set on a key, requests using that key are validated against that whitelist before routing. If the caller sends tags not present in `allowed_tags`, the request is rejected with a 401. If the caller sends no tags, the `allowed_tags` are injected as the default. This ensures a key scoped to `["region:eu"]` can never - accidentally or deliberately - route to a non-EU deployment.

An alternative simpler design would be `enforced_tags`, where the key always forces specific tags regardless of what the caller sends. `allowed_tags` is more flexible and covers a broader set of use cases, which is why I explored it here - but I'm open to discussing which approach makes more sense.

Note that this is also distinct from the existing `metadata.tags` field on keys, which is used solely for spend tracking. `allowed_tags` would operate at the routing layer, not the logging …