feat(api-keys): scopes for triage, tasks and list items (FLAW-07)

Keys get scopes when created (webhook:triage, webhook:task,
webhook:list; default triage, old keys become triage). The webhook
ingest learns target task (optional task list) and list_item (needs a
list the owner may write to); /inbox checks the scope of its target as
well; a missing scope answers 403. Keys can no longer open live streams,
which carried all of the owner's events.

The visible key UI lived in the account settings while EcosystemView
was never rendered; it is replaced by ApiKeysPanel in the settings with
scope chips, scope badges per key and a simulator for all three
targets. Examples send the key as X-API-Key header, not in the URL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/storage/apikeys.go

@@ -10,7 +10,32 @@ import (
 
 // --- API KEYS & WEBHOOKS ---
 
-func (s *Store) CreateAPIKey(userID, name string) (*domain.APIKey, error) {
+// Scopes of an API key: what it may deliver. A key never reads data.
+const (
+	ScopeTriage = "webhook:triage" // thoughts into the inbox
+	ScopeTask   = "webhook:task"   // tasks directly
+	ScopeList   = "webhook:list"   // items into lists
+)
+
+// NormalizeScopes keeps the known scopes in a fixed order; none at all means triage only.
+func NormalizeScopes(scopes []string) []string {
+	want := map[string]bool{}
+	for _, sc := range scopes {
+		want[strings.ToLower(strings.TrimSpace(sc))] = true
+	}
+	out := []string{}
+	for _, sc := range []string{ScopeTriage, ScopeTask, ScopeList} {
+		if want[sc] {
+			out = append(out, sc)
+		}
+	}
+	if len(out) == 0 {
+		out = []string{ScopeTriage}
+	}
+	return out
+}
+
+func (s *Store) CreateAPIKey(userID, name string, scopes []string) (*domain.APIKey, error) {
 	if strings.TrimSpace(name) == "" {
 		name = "Smarthome / Webhook Key"
 	}
@@ -22,7 +47,7 @@ func (s *Store) CreateAPIKey(userID, name string) (*domain.APIKey, error) {
 		KeyPrefix: prefix,
 		KeyHash:   hash,
 		RawKey:    rawKey,
-		Scopes:    "ingest,read",
+		Scopes:    strings.Join(NormalizeScopes(scopes), ","),
 		CreatedAt: domain.NowISO(),
 	}
 
@@ -64,12 +89,19 @@ func (s *Store) DeleteAPIKey(userID, keyID string) error {
 }
 
 func (s *Store) ValidateAPIKeyAndGetUser(rawKey string) (*domain.User, error) {
+	u, _, err := s.ValidateAPIKey(rawKey)
+	return u, err
+}
+
+// ValidateAPIKey returns the owner of a key and the key's scopes.
+func (s *Store) ValidateAPIKey(rawKey string) (*domain.User, []string, error) {
 	hash := auth.HashAPIKey(strings.TrimSpace(rawKey))
-	var keyID, userID string
-	err := s.db.QueryRow(`SELECT id, user_id FROM api_keys WHERE key_hash = ?`, hash).Scan(&keyID, &userID)
+	var keyID, userID, scopes string
+	err := s.db.QueryRow(`SELECT id, user_id, scopes FROM api_keys WHERE key_hash = ?`, hash).Scan(&keyID, &userID, &scopes)
 	if err != nil {
-		return nil, errors.New("invalid API key")
+		return nil, nil, errors.New("invalid API key")
 	}
 	_, _ = s.db.Exec(`UPDATE api_keys SET last_used_at = ? WHERE id = ?`, domain.NowISO(), keyID)
-	return s.GetUserByID(userID)
+	u, err := s.GetUserByID(userID)
+	return u, NormalizeScopes(strings.Split(scopes, ",")), err
 }