✨ feat(auth): add API key management for STT/TTS services

- Add api_keys schema in mana-core-auth with SHA-256 hashing
- Create NestJS module with CRUD endpoints and validation
- Add external auth module to STT/TTS for sk_live_ key validation
- Create web UI page at /api-keys for key management
- Support rate limiting per key with configurable limits
- Cache validation results for 5 minutes to reduce auth service load

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

services/mana-core-auth/src/db/schema/api-keys.schema.ts

@@ -0,0 +1,32 @@
+import { text, timestamp, jsonb, integer, index } from 'drizzle-orm/pg-core';
+import { authSchema, users } from './auth.schema';
+
+/**
+ * API Keys table for programmatic access to services.
+ * Keys are hashed using SHA-256 for security - the full key is only shown once at creation.
+ */
+export const apiKeys = authSchema.table(
+	'api_keys',
+	{
+		id: text('id').primaryKey(), // nanoid
+		userId: text('user_id')
+			.references(() => users.id, { onDelete: 'cascade' })
+			.notNull(),
+		name: text('name').notNull(), // User-friendly name for the key
+		keyPrefix: text('key_prefix').notNull(), // "sk_live_abc..." for display (first 12 chars)
+		keyHash: text('key_hash').notNull(), // SHA-256 hash of the full key
+		scopes: jsonb('scopes').$type<string[]>().default(['stt', 'tts']).notNull(), // Allowed service scopes
+		rateLimitRequests: integer('rate_limit_requests').default(60).notNull(), // Requests per window
+		rateLimitWindow: integer('rate_limit_window').default(60).notNull(), // Window in seconds
+		createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+		lastUsedAt: timestamp('last_used_at', { withTimezone: true }),
+		revokedAt: timestamp('revoked_at', { withTimezone: true }),
+	},
+	(table) => [
+		index('api_keys_user_id_idx').on(table.userId),
+		index('api_keys_key_hash_idx').on(table.keyHash),
+	]
+);
+
+export type ApiKey = typeof apiKeys.$inferSelect;
+export type NewApiKey = typeof apiKeys.$inferInsert;

services/mana-core-auth/src/db/schema/index.ts

@@ -1,3 +1,4 @@
+export * from './api-keys.schema';
 export * from './auth.schema';
 export * from './credits.schema';
 export * from './feedback.schema';