feat: add scoped API keys for programmatic site access

Introduce ApiKey model, CRUD endpoints, and admin UI so agents can
authenticate with permission-scoped keys. Normalize pubkeys to hex on login,
dedupe legacy npub/hex user rows, and ignore .cursor in git.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/lib/api.ts

@@ -110,6 +110,8 @@ export const api = {
 
   // Users
   getUsers: () => request<any[]>("/users"),
+  createUser: (pubkey: string) =>
+    request<any>("/users", { method: "POST", body: JSON.stringify({ pubkey }) }),
   setUserRole: (pubkey: string, role: string | null) =>
     request<any>(`/users/${encodeURIComponent(pubkey)}/role`, {
       method: "PUT",
@@ -134,6 +136,13 @@ export const api = {
       { method: "PUT", body: JSON.stringify({ permissions }) }
     ),
 
+  // API keys
+  getApiKeys: () => request<any[]>("/api-keys"),
+  createApiKey: (data: { name: string; permissions: string[] }) =>
+    request<any>("/api-keys", { method: "POST", body: JSON.stringify(data) }),
+  revokeApiKey: (id: string) =>
+    request<any>(`/api-keys/${encodeURIComponent(id)}`, { method: "DELETE" }),
+
   // Categories
   getCategories: () => request<any[]>("/categories"),
   createCategory: (data: { name: string; slug: string }) =>