feat(api): implement API key management and authentication enhancements

- Added endpoints for managing API keys, including creation, retrieval, updating, and revocation.
- Introduced a new Auth session endpoint to retrieve current tenant and role information.
- Updated the authentication middleware to support API key-based authentication and track last used timestamps.
- Enhanced documentation to reflect new API key functionalities and usage guidelines.
- Improved logging for demo authentication scenarios.

internal/httpapi/server.go

@@ -21,8 +21,7 @@ type Server struct {
 	pgPool      *pgxpool.Pool
 	jobs        *jobs.Registry
 	bundlePriv  ed25519.PrivateKey
-	apiKeys     []apiKeyRecord
-	insecureDev bool
+	keyResolver *apiKeyResolver
 	corsOrigins []string
 	cdnHTTP     *http.Client
 	mux         *http.ServeMux
@@ -60,13 +59,16 @@ func New(opts Options) (*Server, error) {
 		_, priv, _ = ed25519.GenerateKey(rand.Reader)
 	}
 
+	resolver, err := newAPIKeyResolver(opts.APIKeys, backend)
+	if err != nil {
+		return nil, err
+	}
 	s := &Server{
 		store:       backend,
 		pgPool:      pool,
 		jobs:        reg,
 		bundlePriv:  priv,
-		apiKeys:     parseAPIKeysSpec(opts.APIKeys),
-		insecureDev: opts.InsecureDev && opts.SeedDemo,
+		keyResolver: resolver,
 		corsOrigins: parseCORSOrigins(opts.CORSAllowedOrigins),
 		cdnHTTP:     NewCDNHTTPClient(),
 	}