[BetterAndBetterII]

What changed

• add a dedicated user_api_keys entity with hashed storage, status/expiry metadata, and last-used tracking
• extend platform bearer auth so ase_pat_ project-scoped user API keys can call /api/v1/platform/... with project and scope enforcement
• add security settings CRUD endpoints, OpenAPI/contracts, and a project security UI panel for creating, listing, rotating, disabling, and deleting user API keys
• add focused backend/frontend coverage for user API key auth and one-time plaintext token display

Why

OpenASE already had agent/runtime tokens and human RBAC, but users could not safely mint their own long-lived project-scoped API keys for external automation. This change fills that gap without exposing browser sessions or reusing agent runtime credentials.

Validation

• PATH=$HOME/.local/go1.26.1/bin:$PATH go test ./internal/agentplatform
• PATH=$HOME/.local/go1.26.1/bin:$PATH go test ./internal/httpapi -run 'TestAgentPlatformAcceptsProjectScopedUserAPIKeys|TestHTTPAPIErrorMappings|TestSecuritySettingsRouteReturnsCurrentBoundary'
• PATH=$HOME/.local/go1.26.1/bin:$PATH go test ./internal/service/userapikey ./internal/repo/userapikey ./internal/repo/agentplatform
• PATH=$HOME/.local/go1.26.1/bin:$HOME/.nvm/versions/node/v22.22.1/bin:$PATH make openapi-generate
• PATH=$HOME/.nvm/versions/node/v22.22.1/bin:$PATH pnpm --dir web exec vitest run src/lib/features/settings/components/security-settings-user-api-keys.test.ts

Notes

• A broader existing security-settings.test.ts suite still reflects older UI copy and panel structure, so validation stayed focused on the new API-key panel path added in this change.