Enforce uniqueness of API keys

This PR adds a `UNIQUE` constraint on `participants.api_key`, which is needed for consistency and performance.