Scoped API keys

API keys now carry explicit permission scopes. When you create a key you choose exactly what it can do — no more handing out full-access credentials for a read-only integration.

What changed:

• New keys are created through a two-step dialog: pick a name, then check the permissions you want.
• The keys table in the dashboard shows a Scopes column: scoped keys list their permissions as badges, unrestricted keys show "Full access".
• API routes return 403 Forbidden when a key lacks the required scope. The error code is forbidden.

Scoped keys are useful any time you want to give a third-party integration the minimum access it needs — for example, a read-only key for an analytics pipeline or a signup-only key for a landing page.