feat(auth): add admin-managed bot API keys with expiry and revocation

app/repositories/portfolio_repository.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 from datetime import datetime
 from typing import Protocol
 
-from app.domain.models import AuthToken, LedgerEntry, Portfolio, StrategySet, TokenPrincipal, User
+from app.domain.models import AuthToken, BotPrincipal, LedgerEntry, Portfolio, StrategySet, TokenPrincipal, User
 
 
 class PortfolioRepository(Protocol):
@@ -51,6 +51,7 @@ class PortfolioRepository(Protocol):
         token_prefix: str,
         permission: str,
         token_type: str,
+        bot_principal_id: str | None = None,
         expires_at: datetime | None = None,
     ) -> AuthToken: ...
 
@@ -58,6 +59,24 @@ class PortfolioRepository(Protocol):
 
     def revoke_auth_token(self, user_id: str, token_id: str) -> None: ...
 
+    def create_bot_principal(
+        self,
+        *,
+        owner_user_id: str,
+        name: str,
+        description: str | None = None,
+    ) -> BotPrincipal: ...
+
+    def get_bot_principal(self, bot_principal_id: str) -> BotPrincipal: ...
+
+    def list_bot_principals(self, *, is_active: bool | None = None) -> list[BotPrincipal]: ...
+
+    def deactivate_bot_principal(self, bot_principal_id: str) -> BotPrincipal: ...
+
+    def list_bot_auth_tokens(self, bot_principal_id: str) -> list[AuthToken]: ...
+
+    def revoke_bot_auth_token(self, bot_principal_id: str, token_id: str) -> None: ...
+
     def get_token_principal(self, token_hash: str) -> TokenPrincipal | None: ...
 
     def get(self, portfolio_id: str) -> Portfolio: ...