feat: developer access permission gates webhooks/API keys/BYOK (v0.71.0)

Webhooks, self-serve API keys, and BYOK AI provider keys had zero
access gating -- any logged-in user, any tier. Adds users.isDeveloper
(boolean, admin-toggled in admin/users/[id] alongside role/tier),
checked via a single hasDeveloperAccess() (lib/permissions.ts) so a
future subscription-tier auto-grant is a one-line change there, not
a redesign across call sites.

requireDeveloper() (lib/api-auth.ts) wraps requireSession() with a
fresh isDeveloper check (same reasoning as requireAdmin re-querying
role: session.user's cookieCache can be up to 5 minutes stale) and
replaces requireSession in all 8 gated routes: webhooks CRUD +
deliveries + redeliver, api-keys CRUD, ai-keys CRUD.

Settings UI: the sidebar hides API Keys/Webhooks nav entries for
non-developers; those pages and the BYOK section of Settings -> AI
show a locked notice instead of the manager component when accessed
directly.

Migration grandfathers in anyone who already has a webhook, API key,
or BYOK key row -- ships as a new gate on existing features, not a
silent lockout of active integrations.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/(app)/settings/ai/page.tsx

@@ -6,6 +6,7 @@ import { UNLIMITED, getRecipeCount, getStorageUsedMb } from "@/lib/tiers";
 import { ByokManager } from "@/components/settings/byok-manager";
 import { ModelPrefsForm } from "@/components/settings/model-prefs-form";
 import { UsageQuotaSection } from "@/components/settings/usage-quota-section";
+import { DeveloperLockedNotice } from "@/components/settings/developer-locked-notice";
 import { getMessages, formatMessage } from "@/lib/i18n/server";
 
 export const metadata: Metadata = {};
@@ -27,7 +28,7 @@ export default async function AiSettingsPage() {
     }),
     // Tier comes from the DB, not the (up to 5-minute-stale) session cookie
     // cache, so a just-changed tier's limits show up immediately here.
-    db.query.users.findFirst({ where: eq(users.id, session.user.id), columns: { tier: true } }),
+    db.query.users.findFirst({ where: eq(users.id, session.user.id), columns: { tier: true, isDeveloper: true } }),
   ]);
 
   const [tierDef, usage, recipeCount, storageUsedMb] = await Promise.all([
@@ -80,7 +81,11 @@ export default async function AiSettingsPage() {
             {m.settings.byok.description}
           </p>
         </div>
-        <ByokManager initialKeys={aiKeys.map((k) => k.provider)} />
+        {dbUser?.isDeveloper ? (
+          <ByokManager initialKeys={aiKeys.map((k) => k.provider)} />
+        ) : (
+          <DeveloperLockedNotice message={m.settings.developerLockedNotice} />
+        )}
       </section>
 
       <section className="rounded-xl border p-6 space-y-4">