Respect admin mode when enabling deploy keys

What does this MR do and why?

Part of #632943. Projects::EnableDeployKeyService checked admin? to let admins enable any deploy key, so it ignored admin mode.

The service now finds the key and checks enable_deploy_key on it. DeployKeyPolicy grants that under the same conditions as read_deploy_key, which are public keys, keys on the user's projects, and admins in admin mode. An admin who isn't in admin mode can only enable keys they could enable as a regular user.

This is a bug fix, so it isn't behind a feature flag. Instances with the admin mode setting off are not affected.

References

• #632943

Screenshots or screen recordings

No UI change.

How to set up and validate locally

bundle exec rspec spec/policies/deploy_key_policy_spec.rb spec/services/projects/enable_deploy_key_service_spec.rb

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

🤖 Generated with Claude Code