Add per-API-key spend limits

[august-andersen]

What changed

• Add an optional rolling 24-hour USD spend limit when creating an API key.
• Add a pencil action on the API-key settings screen to update or clear that limit.
• Attribute each trial to the exact API key that submitted it, including appended sweeps and retries.
• Enforce the key limit at admission, live cost checkpoints, and final settlement. User and organization quotas still apply, and key-limit cancellation only affects trials launched through that key.
• Add compatible migrations to both Alembic trees and extend the quota startup schema guard.

Why

API keys currently inherit only the submitting user's and organization's budgets. A user who creates keys for CI, contractors, or separate integrations cannot bound the spend of one credential without affecting every other workflow. This gives each key its own budget while retaining the existing broader safeguards.

Verification

• 31 focused backend tests passed.
• 97 focused core and worker tests passed.
• 91 compatibility tests covering quota admission, auto-probes, live tailing, and settlement passed after the final cleanup.
• Frontend TypeScript, ESLint, and Prettier checks passed.
• Ruff, Python compilation, and both Alembic head checks passed.

The full PostgreSQL-backed quota-enforcement integration tests were not run locally because no server was available on localhost:5432. Keep this PR in draft until the preview verifies the frontend, backend, and migrations.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
oddish-app	Ready	Preview	Aug 11, 2026 9:35pm

[github-actions]

Oddish preview

Commit: 54084544908119dc7e82f44075a87c1993e44072

Surface	Link	Target
Frontend	https://pr-1181.oddish.app	Vercel preview for 5408454
Backend	oddish-pr-1181	oddish-pr-1181
Database	project nwnnaniuuwmpzbbqtiwo	project nwnnaniuuwmpzbbqtiwo

Vercel deployment URL: https://oddish-3bt5drds4.oddish.app

Plan:

• Frontend deploy: true
• Backend deploy: true
• Migrations: true

This comment is updated by the PR Preview workflow.