feat(api-keys): add API key CRUD management

.atl/skill-registry.md

@@ -0,0 +1,94 @@
+# Skill Registry — cortex
+
+> Auto-generated by sdd-init. DO NOT edit manually. Re-generate with `sdd-init`.
+
+## Project: cortex
+
+- **Type**: Rust workspace monorepo (Cargo workspace)
+- **Language**: Rust 1.81+ (toolchain 1.89)
+- **Artifact store**: openspec (`openspec/`)
+- **Strict TDD**: false (no inline `#[cfg(test)]` modules; tests are separate test targets)
+
+## Compact Rules
+
+### SDD Workflow
+
+- SDD artifacts live in `openspec/changes/{change-name}/`
+- Phase order: `init → explore → propose → spec → design → tasks → apply → verify → archive`
+- State tracked in `openspec/changes/{change-name}/state.yaml`
+- Resume via `sdd-continue` reading `state.yaml` to determine next phase
+
+### Quality Gates (CI Order)
+
+```
+fmt --check → clippy → check → test → doc → audit
+```
+
+Run locally: `just ci-local`
+
+### Architecture Conventions
+
+- Clean Architecture: `apps/rook` (binary, DI) → `transport-axum` (HTTP) → `rook-usecases` (app) → `rook-core` (domain) → `shared-kernel` (no deps)
+- All port traits: `#[async_trait]`
+- Error handling: `thiserror` enums per domain
+- No inline `#[cfg(test)]` modules — tests live in `tests/` dirs or `#[cfg(test)]` at crate root
+- Newtypes for domain IDs: `SmolStr` wrapper (e.g., `ApiKeyId`, `UserId`, `ProviderId`)
+- SQLite schema: migration on open in `new()` (no separate migration binary)
+
+### Key Patterns
+
+| Pattern | Location | Notes |
+|---------|----------|-------|
+| Use case struct with DI | `rook-usecases/src/manage_connections.rs` → `ManageConnections` | Fields: repo, key_manager, provider builders |
+| Repository trait | `rook-core/src/ports.rs` | `Port = Send + Sync`, async_trait |
+| Repository impl | `auth-sqlite/src/lib.rs` | `SqliteXxxRepository { conn: Mutex<Connection> }` |
+| Migration on open | `auth-sqlite/src/lib.rs` → `run_migration()` | Called from `new()` |
+| Error enum | `rook-core/src/api_key.rs` → `ApiKeyRepositoryError` | Variants: NotFound, DuplicateHash, Database |
+| Rate limiting | `transport-axum/src/middleware/api_key_rate_limiter.rs` | Token bucket, per-tier limits |
+| Encrypted credentials | `encryption-inmemory` | AES-256-GCM + Argon2id key derivation |
+
+### Tooling
+
+- Task runner: `just` (see `justfile`)
+- Git hooks: `lefthook` (`lefthook.yml`)
+- Test: `cargo test --workspace --all-features`
+- Coverage: `cargo llvm-cov --workspace --html`
+- Format: `cargo fmt --all`
+- Clippy (deny warnings): `cargo clippy --workspace --all-targets -- -D warnings`
+
+### Test Files Location
+
+```
+apps/rook/tests/*.rs
+crates/infrastructure/*/tests/*.rs
+```
+
+### Dashboard
+
+- Vue.js at `apps/rook/dashboard/`
+- Dev: `just dev` (watch mode with check + test + clippy)
+
+## Skills (available)
+
+| Skill | Trigger | Purpose |
+|-------|---------|---------|
+| `brainstorming` | Ideas, spikes, isolated behavior | Collaborative thinking without full SDD |
+| `systematic-debugging` | Bug reports, flaky tests | Systematic elimination process |
+| `writing-plans` | Implementation plan from approved design | Temporary, not SDD |
+| `verification-before-completion` | Before claiming work done | Run verification commands |
+| `sdd-*` phases | SDD workflow | See phase command routing |
+
+## Testing Capabilities Detected
+
+| Capability | Status | Command / Evidence |
+|-----------|--------|-------------------|
+| Unit test runner | ✅ | `cargo test --workspace --all-features` |
+| Integration tests | ✅ | `tests/*.rs` in crate dirs |
+| Coverage report | ✅ | `cargo llvm-cov --workspace --html` |
+| Doc tests | ✅ | `cargo test --workspace --doc` |
+| Format check | ✅ | `cargo fmt --all -- --check` |
+| Clippy (deny) | ✅ | `cargo clippy --workspace --all-targets -- -D warnings` |
+| Security audit | ✅ | `cargo audit` |
+| Watch mode | ✅ | `just dev` (cargo watch) |
+
+**No TTD enforcement** — `strict_tdd: false` because inline `#[cfg(test)]` modules are not the primary pattern.

Dockerfile.dev

@@ -54,7 +54,9 @@ COPY dev/test-configs/rook-minimal.toml /app/rook.toml
 # Expose default port
 EXPOSE 8080
 
+# Set config path via env var
+ENV ROOK_CONFIG=/app/rook.toml
+
 USER non-root
 
 ENTRYPOINT ["/usr/local/bin/rook"]
-CMD ["--config", "/app/rook.toml"]

apps/rook/Cargo.toml

@@ -27,6 +27,7 @@ provider-sqlite = { path = "../../crates/infrastructure/provider-sqlite" }
 auth-sqlite = { path = "../../crates/infrastructure/auth-sqlite" }
 tokio = { version = "1", features = ["full"] }
 anyhow = "1"
+clap = { version = "4", features = ["derive"] }
 tracing = "0.1"
 axum = { version = "0.8", features = ["macros"] }
 tower = "0.5"