feat: self-serve developer access for paid tiers, split BYOK into its own permission (v0.72.0)

Splits what was one isDeveloper flag (gating webhooks, API keys, AND
BYOK together) into two independent permissions:

- isDeveloper (webhooks + self-serve API keys): admin-toggled as
  before, but now ALSO self-serve -- PATCH /api/v1/users/me/developer-access
  lets any paid-tier (tier !== "free") user turn it on themselves, no
  added fee. Free tier still needs an admin grant. Turning it off is
  always self-serve regardless of tier, since revoking your own
  access needs no gatekeeping. canSelfServeDeveloperAccess() in
  lib/permissions.ts is the single check for "is this tier eligible."

- isByokEnabled (BYOK AI provider keys): new column, admin-only, no
  self-serve path at all -- routing real AI provider spend through
  Epicure on the user's own key warrants a manual admin check-in that
  webhooks/API access don't need. requireByok() replaces
  requireDeveloper() on the three ai-keys routes.

Migration adds is_byok_enabled and grandfathers in anyone who already
has a BYOK key configured (the earlier grandfather migration only
covered the combined isDeveloper flag, which BYOK no longer reads).

Settings UI: webhooks/API-keys pages show a self-serve "Enable"
toggle for paid-tier non-developers instead of the locked notice
(still shown to free-tier users), plus a "Disable developer access"
link once enabled. Settings -> AI's BYOK section now checks
isByokEnabled instead of isDeveloper -- unaffected by the self-serve
change, still fully admin-gated.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/api-auth.ts

@@ -4,7 +4,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { auth } from "@/lib/auth/server";
 import { db, apiKeys, users, eq } from "@epicure/db";
 import { applyRateLimit } from "@/lib/rate-limit";
-import { hasDeveloperAccess } from "@/lib/permissions";
+import { hasDeveloperAccess, hasByokAccess } from "@/lib/permissions";
 
 export async function requireSession() {
   const session = await auth.api.getSession({ headers: await headers() });
@@ -40,10 +40,10 @@ export async function requireAdmin(opts?: { allowModerator?: boolean }) {
   return { session, response: null };
 }
 
-/** Gates webhooks, self-serve API keys, and BYOK routes behind
- * users.isDeveloper — re-queried fresh for the same reason requireAdmin
- * re-queries role (session.user's cookieCache can be up to 5 minutes
- * stale, e.g. right after an admin grants access). */
+/** Gates webhooks and self-serve API keys behind users.isDeveloper —
+ * re-queried fresh for the same reason requireAdmin re-queries role
+ * (session.user's cookieCache can be up to 5 minutes stale, e.g. right
+ * after a grant). */
 export async function requireDeveloper() {
   const { session, response } = await requireSession();
   if (response) return { session: null, response };
@@ -57,7 +57,28 @@ export async function requireDeveloper() {
   if (!dbUser || !hasDeveloperAccess(dbUser)) {
     return {
       session: null,
-      response: NextResponse.json({ error: "Developer access required — ask an admin to enable it" }, { status: 403 }),
+      response: NextResponse.json({ error: "Developer access required — ask an admin to enable it, or self-enable it in Settings if you're on a paid plan" }, { status: 403 }),
+    };
+  }
+  return { session, response: null };
+}
+
+/** Gates BYOK AI provider key routes behind users.isByokEnabled — admin-only,
+ * no self-serve path (see lib/permissions.ts's hasByokAccess doc comment). */
+export async function requireByok() {
+  const { session, response } = await requireSession();
+  if (response) return { session: null, response };
+
+  const [dbUser] = await db
+    .select({ isByokEnabled: users.isByokEnabled })
+    .from(users)
+    .where(eq(users.id, session!.user.id))
+    .limit(1);
+
+  if (!dbUser || !hasByokAccess(dbUser)) {
+    return {
+      session: null,
+      response: NextResponse.json({ error: "BYOK access required — ask an admin to enable it" }, { status: 403 }),
     };
   }
   return { session, response: null };