feat(auth): add admin-managed bot API keys with expiry and revocation

docs/portfoliohub-spec.md

@@ -81,6 +81,7 @@ Core settings:
 - `PORTFOLIOHUB_DB_ENABLED`: enables DB repository selection when `true`
 - `PORTFOLIOHUB_SESSION_TOKEN_TTL_HOURS`: login session token TTL in hours
 - `PORTFOLIOHUB_CLIENT_TOKEN_DEFAULT_TTL_DAYS`: default client token TTL in days
+- `PORTFOLIOHUB_BOT_TOKEN_DEFAULT_TTL_DAYS`: default bot token TTL in days
 
 Database settings (active source):
 
@@ -284,6 +285,54 @@ Note: Since strategy sets are identified by (name, config) uniqueness, updating
 - Response `204`: no content
 - Response `404`: token not found
 
+#### Create Bot Principal
+
+- `POST /auth/bots`
+- Auth: `admin`
+- Body: `CreateBotPrincipalRequest`
+- Response `201`: `BotPrincipalResponse`
+
+#### List Bot Principals
+
+- `GET /auth/bots`
+- Auth: `admin`
+- Query params:
+  - `is_active` (optional bool)
+- Response `200`: array of `BotPrincipalResponse`
+
+#### Get Bot Principal
+
+- `GET /auth/bots/{bot_id}`
+- Auth: `admin`
+- Response `200`: `BotPrincipalResponse`
+- Response `404`: bot not found
+
+#### Deactivate Bot Principal
+
+- `DELETE /auth/bots/{bot_id}`
+- Auth: `admin`
+- Response `200`: `BotPrincipalResponse`
+- Behavior: deactivates bot and revokes all active tokens linked to the bot
+
+#### Issue Bot Token
+
+- `POST /auth/bots/{bot_id}/tokens`
+- Auth: `admin`
+- Body: `CreateBotTokenRequest`
+- Response `201`: `IssuedBotTokenResponse`
+
+#### List Bot Tokens
+
+- `GET /auth/bots/{bot_id}/tokens`
+- Auth: `admin`
+- Response `200`: array of `AuthTokenResponse`
+
+#### Revoke Bot Token
+
+- `DELETE /auth/bots/{bot_id}/tokens/{token_id}`
+- Auth: `admin`
+- Response `204`: no content
+
 ### 7.6 User Endpoints
 
 All user management endpoints are admin-only.
@@ -386,6 +435,18 @@ Bootstrap rule:
 
 `CreateClientTokenRequest`
 
+- `name: str`
+- `permission: "read" | "trade-write" | "admin" | null`
+- `expires_in_days: int | null`
+
+`CreateBotPrincipalRequest`
+
+- `owner_user_id: str`
+- `name: str`
+- `description: str | null`
+
+`CreateBotTokenRequest`
+
 - `name: str`
 - `permission: "read" | "trade-write" | "admin" | null`
 - `expires_in_days: int | null`
@@ -465,6 +526,17 @@ Bootstrap rule:
 
 - `detail: str`
 
+`BotPrincipalResponse`
+
+- `id: str`
+- `owner_user_id: str`
+- `name: str`
+- `description: str | null`
+- `is_active: bool`
+- `created_at: datetime | null`
+- `updated_at: datetime | null`
+- `deactivated_at: datetime | null`
+
 ## 9. CLI Specification
 
 Global option: