feat: account-level api keys

[kaposke]

Summary
Adds the authentication and authorization foundations for account-level API keys.

Approach
Previously, customer-key authentication joined customer_keys_relations, required an environment relation, and selected one environment during credential lookup. Scope middleware then assumed that environment ownership had already been validated.

Now, authentication resolves the key into a principal containing its account, scopes, and valid environment bindings. Authorization separately checks both the required scope and ownership of the requested target. An environment is inferred only when exactly one valid relation exists; account-only keys require no relation.

This also adds account scopes, a relation-free account-key creation primitive, and relation-aware cleanup when environments are deleted.

[linear-code]

NAN-6468

[cubic-dev-ai]

1 issue found across 143 files

Confidence score: 3/5

• In packages/database/lib/migrations/20260731170000_make_customer_key_environment_cleanup_relation_aware.cjs, concurrent deletion of two environments that share a key can race and leave an environment-only API key orphaned with no relations, creating a data-integrity cleanup gap—lock the affected customer_keys rows before relation removal so the second trigger run re-evaluates against current state.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/database/lib/migrations/20260731170000_make_customer_key_environment_cleanup_relation_aware.cjs">

<violation number="1" location="packages/database/lib/migrations/20260731170000_make_customer_key_environment_cleanup_relation_aware.cjs:16">
P2: Concurrent deletion of two environments sharing a key can leave an environment-only API key behind with no relations. Lock affected `customer_keys` rows before removing relations so the second trigger re-evaluates after the first commits.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Concurrent deletion of two environments sharing a key can leave an environment-only API key behind with no relations. Lock affected customer_keys rows before removing relations so the second trigger re-evaluates after the first commits.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/database/lib/migrations/20260731170000_make_customer_key_environment_cleanup_relation_aware.cjs, line 16:

<comment>Concurrent deletion of two environments sharing a key can leave an environment-only API key behind with no relations. Lock affected `customer_keys` rows before removing relations so the second trigger re-evaluates after the first commits.</comment>

<file context>
@@ -0,0 +1,45 @@
+        DECLARE
+            affected_key_ids INTEGER[];
+        BEGIN
+            SELECT COALESCE(array_agg(customer_key_id), ARRAY[]::INTEGER[])
+            INTO affected_key_ids
+            FROM customer_keys_relations
</file context>