feat: add scoped API keys for programmatic site access

Introduce ApiKey model, CRUD endpoints, and admin UI so agents can
authenticate with permission-scoped keys. Normalize pubkeys to hex on login,
dedupe legacy npub/hex user rows, and ignore .cursor in git.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/constants/permissions.ts

@@ -46,6 +46,8 @@ export const PERMISSIONS: PermissionDef[] = [
 
   { key: 'roles.edit_permissions', label: 'Edit roles and permissions', group: 'Roles' },
 
+  { key: 'api_keys.manage', label: 'Create and manage API keys', group: 'API Keys' },
+
   { key: 'nostr_tools.use', label: 'Use Nostr tools', group: 'Nostr Tools' },
 ];
 
@@ -78,10 +80,12 @@ export function isAssignableRole(role: unknown): role is AssignableRole {
 }
 
 // Default permission sets seeded per role. Admin gets everything except the
-// roles editor, which stays SuperAdmin-only by default. Guest gets nothing and
-// is therefore not represented here.
+// roles editor and API key management, which stay SuperAdmin-only by default.
+// Guest gets nothing and is therefore not represented here.
 export const DEFAULT_ROLE_PERMISSIONS: Record<AssignableRole, PermissionKey[]> = {
-  admin: PERMISSIONS.map((p) => p.key).filter((k) => k !== 'roles.edit_permissions'),
+  admin: PERMISSIONS.map((p) => p.key).filter(
+    (k) => k !== 'roles.edit_permissions' && k !== 'api_keys.manage'
+  ),
   moderator: [
     'events.create',
     'events.edit',