feat(auth): add admin-managed bot API keys with expiry and revocation

app/core/auth.py

@@ -26,6 +26,7 @@ class AuthContext:
     permission: Permission
     user_id: str | None = None
     token_id: str | None = None
+    bot_principal_id: str | None = None
     token_source: str = "env"
 
 def get_auth_repository(settings: Settings = Depends(get_settings)) -> Generator[PortfolioRepository, None, None]:
@@ -63,6 +64,7 @@ def _resolve_auth_context(token: str, settings: Settings, repository: PortfolioR
         permission=Permission(principal.permission),
         user_id=principal.user_id,
         token_id=principal.token_id,
+        bot_principal_id=principal.bot_principal_id,
         token_source="db",
     )
 

app/core/config.py

@@ -30,6 +30,7 @@ class Settings(BaseSettings):
     db_enabled: bool = Field(default=False, validation_alias="PORTFOLIOHUB_DB_ENABLED")
     session_token_ttl_hours: int = Field(default=12, validation_alias="PORTFOLIOHUB_SESSION_TOKEN_TTL_HOURS")
     client_token_default_ttl_days: int = Field(default=365, validation_alias="PORTFOLIOHUB_CLIENT_TOKEN_DEFAULT_TTL_DAYS")
+    bot_token_default_ttl_days: int = Field(default=365, validation_alias="PORTFOLIOHUB_BOT_TOKEN_DEFAULT_TTL_DAYS")
 
     # External services configuration
     timescaledb_host: str = Field(default="localhost", validation_alias="TIMESCALEDB_HOST")