feat: read-only API key scoping

New keys can be created as "Full access" (default, unchanged) or
"Read-only" — read-only keys can only make GET/HEAD/OPTIONS requests,
enforced once in requireSessionOrApiKey (lib/api-auth.ts) rather than in
every route, since a route has no way to know a request came from a
scoped key without that check. Existing keys default to full access —
no behavior change for anyone who doesn't opt in.

Also included in this migration: the chat_messages table for the
next commit (chat history persistence) — generated together since both
touched packages/db/src/schema/users.ts in the same pass.

Verified locally: created both a read-only and a full-access key,
confirmed GET succeeds and POST 403s on the read-only key, confirmed
POST still works on the full-access key, and checked the scope badges
render correctly in the real Settings → API Keys UI.

apps/web/app/(app)/settings/api-keys/page.tsx

@@ -18,6 +18,7 @@ export default async function ApiKeysPage() {
     .select({
       id: apiKeys.id,
       name: apiKeys.name,
+      scope: apiKeys.scope,
       lastUsedAt: apiKeys.lastUsedAt,
       createdAt: apiKeys.createdAt,
     })
@@ -45,6 +46,7 @@ export default async function ApiKeysPage() {
           initialKeys={keys.map((k) => ({
             id: k.id,
             name: k.name,
+            scope: k.scope,
             lastUsedAt: k.lastUsedAt ? k.lastUsedAt.toISOString() : null,
             createdAt: k.createdAt.toISOString(),
           }))}