feat(auth): add admin-managed bot API keys with expiry and revocation

app/schemas/auth.py

@@ -51,7 +51,8 @@ class AuthTokenResponse(BaseModel):
     name: str
     token_prefix: str
     permission: Literal["read", "trade-write", "admin"]
-    token_type: Literal["session", "client"]
+    token_type: Literal["session", "client", "bot"]
+    bot_principal_id: str | None = None
     expires_at: datetime | None = None
     last_used_at: datetime | None = None
     revoked_at: datetime | None = None
@@ -59,6 +60,51 @@ class AuthTokenResponse(BaseModel):
 
 
 class IssuedClientTokenResponse(BaseModel):
+    token: str
+    token_type: Literal["bearer"] = "bearer"
+    auth_token: AuthTokenResponse
+
+
+class CreateBotPrincipalRequest(BaseModel):
+    owner_user_id: str = Field(min_length=1)
+    name: str = Field(min_length=1)
+    description: str | None = None
+
+    @field_validator("name")
+    @classmethod
+    def normalize_bot_name(cls, value: str) -> str:
+        normalized = value.strip()
+        if not normalized:
+            raise ValueError("name은 비어 있을 수 없습니다")
+        return normalized
+
+
+class BotPrincipalResponse(BaseModel):
+    id: str
+    owner_user_id: str
+    name: str
+    description: str | None = None
+    is_active: bool
+    created_at: datetime | None = None
+    updated_at: datetime | None = None
+    deactivated_at: datetime | None = None
+
+
+class CreateBotTokenRequest(BaseModel):
+    name: str = Field(min_length=1)
+    permission: Literal["read", "trade-write", "admin"] | None = None
+    expires_in_days: int | None = Field(default=None, ge=1, le=3650)
+
+    @field_validator("name")
+    @classmethod
+    def normalize_token_name(cls, value: str) -> str:
+        normalized = value.strip()
+        if not normalized:
+            raise ValueError("name은 비어 있을 수 없습니다")
+        return normalized
+
+
+class IssuedBotTokenResponse(BaseModel):
     token: str
     token_type: Literal["bearer"] = "bearer"
     auth_token: AuthTokenResponse