feat: REST API v1 + API key management + Swagger docs
**API system**
- ApiKey model: SHA-256-hashed tokens (gw_<hex>), per-family, scoped
- Migration: 20260615210000_api_keys
- src/lib/api-auth.ts: verifyApiKey(), hasScope(), generateApiKey(), prepareKey()
**V1 endpoints** (all require Bearer gw_ token):
- GET /api/v1/babies — list family babies (any read scope)
- GET /api/v1/events — query events (events:read), babyId/type/from/to/limit/offset
- POST /api/v1/events — log event (events:write), full metadata support
- GET /api/v1/growth — growth logs (growth:read)
- POST /api/v1/growth — add measurement (growth:write), weight in grams
- GET /api/v1/summary — today's counts + sleep + last feed (summary:read)
- GET /api/v1/milk — stock lots + totalMl (milk:read)
**API key management**
- GET /api/api-keys — list keys (session auth)
- POST /api/api-keys — create key, returns raw token once (session auth)
- DELETE /api/api-keys/[id] — revoke key (session auth)
**Documentation**
- GET /api/v1/openapi.json — OpenAPI 3.0 spec (CORS open)
- GET /api-docs — Swagger UI (CDN, dark themed)
**Settings UI** — "Clés API" section: create key with scope checkboxes, copy token banner (shown once), revoke, link to /api-docs
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
arnaudne
f59a6c5d8a