feat: refine api key permissions and admin routes

apps/api/internal/httpapi/handlers.go

@@ -142,6 +142,33 @@ func (s *Server) listPlatforms(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]any{"items": platforms})
 }
 
+func (s *Server) listPlayablePlatforms(w http.ResponseWriter, r *http.Request) {
+	user, _ := auth.UserFromContext(r.Context())
+	models, err := s.store.ListAccessiblePlatformModels(r.Context(), user)
+	if err != nil {
+		s.logger.Error("list playable platform models failed", "error", err)
+		writeError(w, http.StatusInternalServerError, "list playable platforms failed")
+		return
+	}
+	allowedPlatformIDs := map[string]bool{}
+	for _, model := range models {
+		allowedPlatformIDs[model.PlatformID] = true
+	}
+	platforms, err := s.store.ListPlatforms(r.Context())
+	if err != nil {
+		s.logger.Error("list platforms failed", "error", err)
+		writeError(w, http.StatusInternalServerError, "list playable platforms failed")
+		return
+	}
+	filtered := platforms[:0]
+	for _, platform := range platforms {
+		if platform.Status == "enabled" && allowedPlatformIDs[platform.ID] {
+			filtered = append(filtered, platform)
+		}
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"items": filtered})
+}
+
 func (s *Server) createPlatform(w http.ResponseWriter, r *http.Request) {
 	var input store.CreatePlatformInput
 	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
@@ -406,6 +433,25 @@ func (s *Server) disableAPIKey(w http.ResponseWriter, r *http.Request) {
 	writeError(w, http.StatusInternalServerError, "disable api key failed")
 }
 
+func (s *Server) deleteAPIKey(w http.ResponseWriter, r *http.Request) {
+	user, _ := auth.UserFromContext(r.Context())
+	err := s.store.DeleteAPIKey(r.Context(), r.PathValue("apiKeyID"), user)
+	if err == nil {
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+	if errors.Is(err, store.ErrLocalUserRequired) {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	if store.IsNotFound(err) {
+		writeError(w, http.StatusNotFound, "api key not found")
+		return
+	}
+	s.logger.Error("delete api key failed", "error", err)
+	writeError(w, http.StatusInternalServerError, "delete api key failed")
+}
+
 func (s *Server) estimatePricing(w http.ResponseWriter, r *http.Request) {
 	user, _ := auth.UserFromContext(r.Context())
 	var body map[string]any