feat: REST API v1 + API key management + Swagger docs

**API system**
- ApiKey model: SHA-256-hashed tokens (gw_<hex>), per-family, scoped
- Migration: 20260615210000_api_keys
- src/lib/api-auth.ts: verifyApiKey(), hasScope(), generateApiKey(), prepareKey()

**V1 endpoints** (all require Bearer gw_ token):
- GET  /api/v1/babies              — list family babies (any read scope)
- GET  /api/v1/events              — query events (events:read), babyId/type/from/to/limit/offset
- POST /api/v1/events              — log event (events:write), full metadata support
- GET  /api/v1/growth              — growth logs (growth:read)
- POST /api/v1/growth              — add measurement (growth:write), weight in grams
- GET  /api/v1/summary             — today's counts + sleep + last feed (summary:read)
- GET  /api/v1/milk                — stock lots + totalMl (milk:read)

**API key management**
- GET  /api/api-keys               — list keys (session auth)
- POST /api/api-keys               — create key, returns raw token once (session auth)
- DELETE /api/api-keys/[id]        — revoke key (session auth)

**Documentation**
- GET /api/v1/openapi.json         — OpenAPI 3.0 spec (CORS open)
- GET /api-docs                    — Swagger UI (CDN, dark themed)

**Settings UI** — "Clés API" section: create key with scope checkboxes, copy token banner (shown once), revoke, link to /api-docs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/app/api/v1/growth/route.ts

@@ -0,0 +1,53 @@
+import { NextResponse } from "next/server";
+import { prisma } from "@/lib/prisma";
+import { verifyApiKey, hasScope } from "@/lib/api-auth";
+
+export async function GET(req: Request) {
+  const ctx = await verifyApiKey(req);
+  if (!ctx) return NextResponse.json({ error: "Invalid or missing API key" }, { status: 401 });
+  if (!hasScope(ctx, "growth:read")) return NextResponse.json({ error: "Insufficient scope — requires growth:read" }, { status: 403 });
+
+  const { searchParams } = new URL(req.url);
+  const babyId = searchParams.get("babyId");
+  if (!babyId) return NextResponse.json({ error: "babyId is required" }, { status: 400 });
+
+  const baby = await prisma.baby.findFirst({ where: { id: babyId, familyId: ctx.familyId } });
+  if (!baby) return NextResponse.json({ error: "Baby not found" }, { status: 404 });
+
+  const logs = await prisma.growthLog.findMany({
+    where: { babyId },
+    orderBy: { date: "asc" },
+    select: { id: true, date: true, weight: true, height: true, headCirc: true, notes: true, createdAt: true },
+  });
+
+  return NextResponse.json({ logs });
+}
+
+export async function POST(req: Request) {
+  const ctx = await verifyApiKey(req);
+  if (!ctx) return NextResponse.json({ error: "Invalid or missing API key" }, { status: 401 });
+  if (!hasScope(ctx, "growth:write")) return NextResponse.json({ error: "Insufficient scope — requires growth:write" }, { status: 403 });
+
+  const body = await req.json().catch(() => null);
+  if (!body) return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+
+  const { babyId, date, weight, height, headCirc, notes } = body;
+  if (!babyId || !date) return NextResponse.json({ error: "babyId and date are required" }, { status: 400 });
+
+  const baby = await prisma.baby.findFirst({ where: { id: babyId, familyId: ctx.familyId } });
+  if (!baby) return NextResponse.json({ error: "Baby not found" }, { status: 404 });
+
+  const log = await prisma.growthLog.create({
+    data: {
+      babyId,
+      date: new Date(date),
+      weight: weight != null ? Number(weight) : null,
+      height: height != null ? Number(height) : null,
+      headCirc: headCirc != null ? Number(headCirc) : null,
+      notes: notes ?? null,
+    },
+    select: { id: true, date: true, weight: true, height: true, headCirc: true, notes: true, createdAt: true },
+  });
+
+  return NextResponse.json({ log }, { status: 201 });
+}