### What happened?

`/key/regenerate` preserves the virtual key's DB config, including `model_max_budget`, but resets the active model budget spend window.

After regenerating a key that is already over its `model_max_budget` for a model, the newly returned key can make at least one successful request before budget enforcement catches up under the new token hash.

This means key rotation can temporarily bypass per-model virtual-key budgets.

### Repro

1. Configure a virtual key with a very small model budget:

```bash curl -X POST "$BASE/key/update" \ -H "Authorization: Bearer $MASTER_KEY" \ -H "Content-Type: application/json" \ --data '{ "key": "sk-old-key", "models": ["claude-opus-4-7"], "aliases": { "claude-opus-4-7": "claude-opus-4-7-bedrock" }, "model_max_budget": { "claude-opus-4-7": { "budget_limit": 0.0000001, "time_period": "1d" } } }' ```

2. Make requests until the key is blocked:

```bash curl -i "$BASE/chat/completions" \ -H "Authorization: Bearer sk-old-key" \ -H "Content-Type: application/json" \ --data '{ "model": "claude-opus-4-7", "messages": [{"role": "user", "content": "budget test"…