fix(access): 修正 API Key 可分配模型范围

apps/api/internal/store/access_rules_test.go

@@ -0,0 +1,23 @@
+package store
+
+import "testing"
+
+func TestFilterAccessRulesBySubjectTypeExcludesAPIKeyRulesOnly(t *testing.T) {
+	rules := []AccessRule{
+		{ID: "api-key-allow", SubjectType: "api_key", Effect: "allow"},
+		{ID: "api-key-deny", SubjectType: "api_key", Effect: "deny"},
+		{ID: "user-group-allow", SubjectType: "user_group", Effect: "allow"},
+		{ID: "user-deny", SubjectType: "user", Effect: "deny"},
+		{ID: "tenant-allow", SubjectType: "tenant", Effect: "allow"},
+	}
+
+	filtered := filterAccessRulesBySubjectType(rules, map[string]bool{"api_key": true})
+	if len(filtered) != 3 {
+		t.Fatalf("filtered rule count = %d, want 3: %+v", len(filtered), filtered)
+	}
+	for _, rule := range filtered {
+		if rule.SubjectType == "api_key" {
+			t.Fatalf("api-key rule should not affect the owning user's assignable resources: %+v", rule)
+		}
+	}
+}