feat: add scoped API keys for programmatic site access

Introduce ApiKey model, CRUD endpoints, and admin UI so agents can
authenticate with permission-scoped keys. Normalize pubkeys to hex on login,
dedupe legacy npub/hex user rows, and ignore .cursor in git.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/services/pubkey.ts

@@ -0,0 +1,24 @@
+import { nip19 } from 'nostr-tools';
+
+// Relays and the rest of the app key identities by lowercase hex pubkeys.
+// Pubkeys may arrive as npub/nprofile, so normalize them to hex. Returns null
+// when the input cannot be interpreted as a pubkey.
+export function toHexPubkey(pubkey: string | null | undefined): string | null {
+  if (!pubkey) return null;
+  const trimmed = pubkey.trim();
+  if (/^[0-9a-f]{64}$/i.test(trimmed)) return trimmed.toLowerCase();
+  try {
+    const decoded = nip19.decode(trimmed);
+    if (decoded.type === 'npub') return decoded.data as string;
+    if (decoded.type === 'nprofile') return (decoded.data as { pubkey: string }).pubkey;
+  } catch {
+    // fall through
+  }
+  return null;
+}
+
+// Normalizes to hex when possible, otherwise returns the trimmed original so we
+// never silently drop an identity we cannot decode.
+export function normalizePubkey(pubkey: string): string {
+  return toHexPubkey(pubkey) ?? pubkey.trim();
+}