feat(auth): add admin-managed bot API keys with expiry and revocation

README.md

@@ -32,7 +32,7 @@ When deploying to production, set environment variables directly instead of usin
 - **DB repository switch**: `PORTFOLIOHUB_DB_ENABLED` (enables DB-backed persistence)
 - **Initial user bootstrap**: `PORTFOLIOHUB_BOOTSTRAP_USERNAME`, `PORTFOLIOHUB_BOOTSTRAP_EMAIL`
 - **Initial user password**: `PORTFOLIOHUB_BOOTSTRAP_PASSWORD`
-- **Session/token TTL**: `PORTFOLIOHUB_SESSION_TOKEN_TTL_HOURS`, `PORTFOLIOHUB_CLIENT_TOKEN_DEFAULT_TTL_DAYS`
+- **Session/token TTL**: `PORTFOLIOHUB_SESSION_TOKEN_TTL_HOURS`, `PORTFOLIOHUB_CLIENT_TOKEN_DEFAULT_TTL_DAYS`, `PORTFOLIOHUB_BOT_TOKEN_DEFAULT_TTL_DAYS`
 - **TimescaleDB / PostgreSQL**: `TIMESCALEDB_*` (single source of DB connection settings)
 - **Redis**: `REDIS_*` (for caching and sessions)
 - **Loki**: `LOKI_*` (for centralized logging)
@@ -177,6 +177,12 @@ Frontend and app authentication is exposed through `/auth`.
 - `GET /auth/tokens`: list current user's issued tokens
 - `POST /auth/tokens`: issue a client token for app/script usage
 - `DELETE /auth/tokens/{token_id}`: revoke a previously issued token
+- `POST /auth/bots`: create external bot principal (admin only)
+- `GET /auth/bots`: list bot principals (admin only)
+- `POST /auth/bots/{bot_id}/tokens`: issue bot API key with expiration (admin only)
+- `GET /auth/bots/{bot_id}/tokens`: list bot keys (admin only)
+- `DELETE /auth/bots/{bot_id}/tokens/{token_id}`: revoke bot key (admin only)
+- `DELETE /auth/bots/{bot_id}`: deactivate bot and revoke linked keys (admin only)
 
 Example API calls: