#5 Tier-4

• Added support for JWT authentication, allowing users to exchange API keys for JWTs via the new /auth/token endpoint.
• Introduced API key management with routes for listing and creating API keys, enhancing security and user control.
• Updated the OpenAPI specification to reflect new authentication methods and security schemes.
• Enhanced the principal resolution logic to support JWTs and API keys, improving authorization handling across the application.
• Added tests to ensure proper functionality of the new authentication features and their integration with existing components.

---

Summary by cubic

Adds JWT auth with an /auth/token exchange and hashed API keys, and updates principal resolution to accept JWTs or API keys. Also adds DO-backed rate limiting, KV caching for session lists, structured logging, and SPA upgrades (Owner switcher, API key UI, PWA/offline, i18n, scorecard export).

• New Features

  • Auth: POST /auth/token (HS256, 1h TTL), API key list/create/revoke (hashed in DB), updated OpenAPI, and JWT/API key resolution across routes; web uses AuthProvider + OwnerSwitcher with demo keys still supported.
  • Scale: RateLimiter Durable Object per IP, KV cache for GET /sessions (60s KV / 15s HTTP, X-Cache), structured JSON logs with X-Trace-Id, and deep readiness GET /health?deep=1.
  • DX/Docs/Tests: OpenAPI exported to /openapi.json with Redoc page, contract + unit + visual tests added, and wrangler@4 upgrade.
  • UX: PWA via vite-plugin-pwa with offline read-only cache (React Query persistence), react-i18next (en), scorecard export, improved file input, and optional analytics.

• Migration

  • Run DB migrations to create api_keys (e.g. npm run db:prepare).
  • Set OCHE_JWT_SECRET (Wrangler secret) and sync .dev.vars; keep demo keys for local use.
  • Bind RATE_LIMITER DO and CACHE KV in apps/api/wrangler.toml (apply migrations).
  • Rebuild web (OpenAPI export runs in apps/web build).