feat: self-serve developer access for paid tiers, split BYOK into its own permission (v0.72.0)

Splits what was one isDeveloper flag (gating webhooks, API keys, AND
BYOK together) into two independent permissions:

- isDeveloper (webhooks + self-serve API keys): admin-toggled as
  before, but now ALSO self-serve -- PATCH /api/v1/users/me/developer-access
  lets any paid-tier (tier !== "free") user turn it on themselves, no
  added fee. Free tier still needs an admin grant. Turning it off is
  always self-serve regardless of tier, since revoking your own
  access needs no gatekeeping. canSelfServeDeveloperAccess() in
  lib/permissions.ts is the single check for "is this tier eligible."

- isByokEnabled (BYOK AI provider keys): new column, admin-only, no
  self-serve path at all -- routing real AI provider spend through
  Epicure on the user's own key warrants a manual admin check-in that
  webhooks/API access don't need. requireByok() replaces
  requireDeveloper() on the three ai-keys routes.

Migration adds is_byok_enabled and grandfathers in anyone who already
has a BYOK key configured (the earlier grandfather migration only
covered the combined isDeveloper flag, which BYOK no longer reads).

Settings UI: webhooks/API-keys pages show a self-serve "Enable"
toggle for paid-tier non-developers instead of the locked notice
(still shown to free-tier users), plus a "Disable developer access"
link once enabled. Settings -> AI's BYOK section now checks
isByokEnabled instead of isDeveloper -- unaffected by the self-serve
change, still fully admin-gated.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/db/src/migrations/0061_stormy_the_fallen.sql

@@ -0,0 +1,9 @@
+ALTER TABLE "users" ADD COLUMN "is_byok_enabled" boolean DEFAULT false NOT NULL;
+--> statement-breakpoint
+-- Grandfather in anyone who already has a BYOK AI key configured -- BYOK
+-- is now its own gate (previously covered by is_developer, per the
+-- migration in 0060), so without this backfill every existing BYOK setup
+-- would silently break the moment this migration runs.
+UPDATE "users" SET "is_byok_enabled" = true WHERE "id" IN (
+	SELECT "user_id" FROM "user_ai_keys"
+);

packages/db/src/migrations/meta/_journal.json

@@ -428,6 +428,13 @@
       "when": 1784706150797,
       "tag": "0060_wandering_mongoose",
       "breakpoints": true
+    },
+    {
+      "idx": 61,
+      "version": "7",
+      "when": 1784791587563,
+      "tag": "0061_stormy_the_fallen",
+      "breakpoints": true
     }
   ]
 }

packages/db/src/schema/users.ts

@@ -33,10 +33,16 @@ export const users = pgTable("users", {
   role: userRoleEnum("role").notNull().default("user"),
   tier: tierEnum("tier").notNull().default("free"),
   // Orthogonal to both role (staff hierarchy) and tier (billing plan) —
-  // gates webhooks, self-serve API keys, and BYOK AI provider keys.
-  // Admin-granted only for now; hasDeveloperAccess() in lib/permissions.ts
-  // is the single place a future tier-based auto-grant would be added.
+  // gates webhooks and self-serve API keys. Admin-settable always; also
+  // self-serve toggleable by the user themselves once on a paid tier (no
+  // added fee) via PATCH /api/v1/users/me/developer-access — see
+  // hasDeveloperAccess() in lib/permissions.ts.
   isDeveloper: boolean("is_developer").notNull().default(false),
+  // Separate from isDeveloper on purpose — BYOK means routing real AI
+  // provider spend through Epicure on the user's own key, which warrants a
+  // manual admin check-in rather than blanket self-serve. Admin-only, no
+  // self-serve path. See hasByokAccess() in lib/permissions.ts.
+  isByokEnabled: boolean("is_byok_enabled").notNull().default(false),
   stripeCustomerId: text("stripe_customer_id").unique(),
   unitPref: unitPrefEnum("unit_pref").notNull().default("metric"),
   locale: text("locale").notNull().default("en"),