feat(api-keys): add platform-scoped API keys for control-plane automation

Introduce platform API keys with capability-based access to tenant management,
system settings, runtime queues, and audit logs, plus admin UI for key lifecycle
and system audit log viewing.

migrations/sqlite/000071_platform_api_keys.down.sql

@@ -0,0 +1,40 @@
+DELETE FROM tenant_api_keys WHERE scope_type = 'platform';
+
+DROP INDEX IF EXISTS idx_tenant_api_keys_tenant;
+DROP INDEX IF EXISTS idx_tenant_api_keys_revoked_at;
+DROP INDEX IF EXISTS idx_tenant_api_keys_scope_type;
+
+ALTER TABLE tenant_api_keys RENAME TO tenant_api_keys_platform_scope;
+
+CREATE TABLE tenant_api_keys (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    tenant_id INTEGER NOT NULL,
+    name TEXT NOT NULL,
+    key_hash TEXT NOT NULL UNIQUE,
+    api_key TEXT NOT NULL DEFAULT '',
+    full_access BOOLEAN NOT NULL DEFAULT 0,
+    knowledge_base_ids TEXT NOT NULL DEFAULT '[]',
+    capabilities TEXT NOT NULL DEFAULT '[]',
+    last_used_at DATETIME,
+    expires_at DATETIME,
+    revoked_at DATETIME,
+    created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    FOREIGN KEY (tenant_id) REFERENCES tenants(id) ON DELETE CASCADE
+);
+
+INSERT INTO tenant_api_keys (
+    id, tenant_id, name, key_hash, api_key, full_access,
+    knowledge_base_ids, capabilities, last_used_at, expires_at, revoked_at,
+    created_at, updated_at
+)
+SELECT
+    id, tenant_id, name, key_hash, api_key, full_access,
+    knowledge_base_ids, capabilities, last_used_at, expires_at, revoked_at,
+    created_at, updated_at
+FROM tenant_api_keys_platform_scope;
+
+DROP TABLE tenant_api_keys_platform_scope;
+
+CREATE INDEX idx_tenant_api_keys_tenant ON tenant_api_keys(tenant_id);
+CREATE INDEX idx_tenant_api_keys_revoked_at ON tenant_api_keys(revoked_at);