feat(auth): add API key authentication for third-party access

[Devsol-01]

• Add ApiKey entity to support securely stored hashed API keys with scopes,
  expiration dates, revocation status, and usage tracking
• Implement ApiKeyService for generating, hashing, validating, and managing
  API keys throughout their lifecycle
• Add ApiKeyGuard to authenticate requests using the X-API-Key header while
  attaching authenticated key information to request.user
• Create JWT-protected API key controller endpoints for issuing and managing
  third-party credentials
• Add scope-based authorization using the @scopes() decorator and enforce
  permission checks for API key requests
• Add migration to create and manage the api_keys database table
• Register API key components in the auth module
• Add throttled last_used_at updates to prevent unnecessary database writes
  on frequent API requests
• Ensure revoked or expired API keys are rejected with proper authentication
  errors

This introduces secure long-lived credentials for server-to-server integrations
while keeping the existing JWT authentication flow unchanged.

closes #1002

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
insight-arena-4rll	Ready	Preview, Comment	Jun 23, 2026 10:36am