feat: read-only API key scoping

New keys can be created as "Full access" (default, unchanged) or
"Read-only" — read-only keys can only make GET/HEAD/OPTIONS requests,
enforced once in requireSessionOrApiKey (lib/api-auth.ts) rather than in
every route, since a route has no way to know a request came from a
scoped key without that check. Existing keys default to full access —
no behavior change for anyone who doesn't opt in.

Also included in this migration: the chat_messages table for the
next commit (chat history persistence) — generated together since both
touched packages/db/src/schema/users.ts in the same pass.

Verified locally: created both a read-only and a full-access key,
confirmed GET succeeds and POST 403s on the read-only key, confirmed
POST still works on the full-access key, and checked the scope badges
render correctly in the real Settings → API Keys UI.

apps/web/components/settings/api-keys-manager.tsx

@@ -7,10 +7,14 @@ import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import { Badge } from "@/components/ui/badge";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+
+type ApiKeyScope = "full" | "read";
 
 type ApiKey = {
   id: string;
   name: string;
+  scope: ApiKeyScope;
   lastUsedAt: string | null;
   createdAt: string;
 };
@@ -18,6 +22,7 @@ type ApiKey = {
 type CreateApiKeyResponse = {
   id: string;
   name: string;
+  scope: ApiKeyScope;
   key: string;
   createdAt: string;
 };
@@ -34,6 +39,7 @@ export function ApiKeysManager({ initialKeys }: { initialKeys: ApiKey[] }) {
   const t = useTranslations("settingsForm");
   const [keys, setKeys] = useState<ApiKey[]>(initialKeys);
   const [name, setName] = useState("");
+  const [scope, setScope] = useState<ApiKeyScope>("full");
   const [creating, setCreating] = useState(false);
   const [newKey, setNewKey] = useState<string | null>(null);
   const [copied, setCopied] = useState(false);
@@ -46,7 +52,7 @@ export function ApiKeysManager({ initialKeys }: { initialKeys: ApiKey[] }) {
       const res = await fetch("/api/v1/api-keys", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ name: name.trim() }),
+        body: JSON.stringify({ name: name.trim(), scope }),
       });
       if (!res.ok) {
         const data = await res.json() as { error?: string };
@@ -55,10 +61,11 @@ export function ApiKeysManager({ initialKeys }: { initialKeys: ApiKey[] }) {
       const data = await res.json() as CreateApiKeyResponse;
       setNewKey(data.key);
       setKeys((prev) => [
-        { id: data.id, name: data.name, lastUsedAt: null, createdAt: data.createdAt },
+        { id: data.id, name: data.name, scope: data.scope, lastUsedAt: null, createdAt: data.createdAt },
         ...prev,
       ]);
       setName("");
+      setScope("full");
     } catch (err) {
       toast.error(err instanceof Error ? err.message : t("apiKeyCreateFailed"));
     } finally {
@@ -105,10 +112,20 @@ export function ApiKeysManager({ initialKeys }: { initialKeys: ApiKey[] }) {
               maxLength={100}
               required
             />
+            <Select value={scope} onValueChange={(v) => setScope(v as ApiKeyScope)}>
+              <SelectTrigger className="w-36">
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="full">{t("apiKeyScopeFull")}</SelectItem>
+                <SelectItem value="read">{t("apiKeyScopeRead")}</SelectItem>
+              </SelectContent>
+            </Select>
             <Button type="submit" disabled={creating || !name.trim()}>
               {creating ? t("apiKeyCreating") : t("apiKeyCreate")}
             </Button>
           </div>
+          <p className="text-xs text-muted-foreground">{t("apiKeyScopeHelp")}</p>
         </div>
       </form>
 
@@ -146,7 +163,12 @@ export function ApiKeysManager({ initialKeys }: { initialKeys: ApiKey[] }) {
           {keys.map((k) => (
             <div key={k.id} className="flex items-center justify-between px-4 py-3 gap-4">
               <div className="min-w-0 flex-1 space-y-1">
-                <p className="text-sm font-medium truncate">{k.name}</p>
+                <div className="flex items-center gap-2">
+                  <p className="text-sm font-medium truncate">{k.name}</p>
+                  <Badge variant={k.scope === "read" ? "secondary" : "default"} className="text-xs">
+                    {k.scope === "read" ? t("apiKeyScopeRead") : t("apiKeyScopeFull")}
+                  </Badge>
+                </div>
                 <div className="flex items-center gap-2 text-xs text-muted-foreground">
                   <span>{t("createdOn", { date: formatDate(k.createdAt) })}</span>
                   <span>·</span>