Enforce uniqueness of api_key

This PR adds a `UNIQUE` constraint on `participants.api_key`, which is needed for consistency and performance.