Added API keys to acquire JWTs for programmatic access

[markmnl]

No description provided.

[Copilot]

Pull request overview

Adds first-party API-key authentication to enable programmatic clients to exchange opaque API keys for short-lived Ed25519-signed JWTs, plus sub-account management routes and a CLI for key lifecycle operations.

Changes:

• Introduces API-key JWT minting/verification (Ed25519) alongside existing RS256/JWKS auth, including optional “act-as” support for owners.
• Adds new HTTP routes for /fmsg/token and /fmsg/sub-accounts*, plus PostgreSQL schema for API-key/sub-account storage.
• Updates server configuration (env vars, trusted proxies, CORS) and documentation to reflect the new auth mode.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Documents new API-key auth mode, env vars, routes, and CLI usage.
internal/middleware/jwt.go	Extends auth middleware to support RS256 and Ed25519 API-token verification, plus act-as.
internal/middleware/jwt_test.go	Updates/extends middleware tests for act-as and API-token flows.
internal/middleware/cors.go	Allows X-FMSG-Act-As header in CORS config.
internal/handlers/ws.go	Switches WebSocket auth to the new request-aware verifier API.
internal/handlers/token.go	Adds /fmsg/token handler to exchange API keys for JWTs.
internal/handlers/subaccounts.go	Adds sub-account CRUD + key rotation handlers gated to RS256 owner auth.
internal/apiauth/token.go	Implements Ed25519 JWT issuer + claims and key parsing helpers.
internal/apiauth/subaccount.go	Implements agent validation, sub-account address derivation, CIDR validation.
internal/apiauth/store.go	Adds DB-backed store for sub-accounts, API-key validation, CIDR enforcement.
internal/apiauth/apikey.go	Implements API key generation/parsing/hashing.
internal/apiauth/apikey_test.go	Adds tests for API-key and key parsing utilities.
cmd/fmsg-webapi/main.go	Wires env/config, trusted proxies, and registers token/sub-account routes + CLI entrypoint.
cmd/fmsg-webapi/apikey_cli.go	Adds `api-key create
api_keys.sql	Adds fmsg_api_sub_account table + indexes/checks supporting API keys/sub-accounts.