feat(vnext2): add user key self-service skeleton

- PORTAL_KEY_EXPERIENCE.md: review from pending to approved
- KEY_SELF_SERVICE_API.md: review from pending to approved
- 0015_user_keys.sql: migration for key_records table
- user_keys_repo.go + test: SQLite repo (Create/ListByOwner/GetByID/UpdateStatus)
- key_self_service.go: HTTP handlers (POST/GET /api/keys, pause/resume/delete)
- key_self_service_svc.go: action wiring (buildUserKeyHandler)
- registered in ActionSet + NewAPIHandlerWithAuth

Note: full user auth requires host+CRM co-deployment.
Current skeleton accepts Bearer token for testing.

internal/app/http_api.go

@@ -78,6 +78,7 @@ type ActionSet struct {
 	UpdateProviderAccountBinding        func(context.Context, UpdateProviderAccountBindingRequest) (ProviderAccountInfo, error)
 	EnableProviderAccount               func(context.Context, UpdateProviderAccountStatusRequest) (ProviderAccountInfo, error)
 	DisableProviderAccount              func(context.Context, UpdateProviderAccountStatusRequest) (ProviderAccountInfo, error)
+	UserKeyHandler                      *UserKeyHandler
 	RetireProviderAccount               func(context.Context, UpdateProviderAccountStatusRequest) (ProviderAccountInfo, error)
 	CreateProviderDraft                 func(context.Context, CreateProviderDraftRequest) (ProviderDraftInfo, error)
 	ListProviderDrafts                  func(context.Context, ListProviderDraftsRequest) ([]ProviderDraftInfo, error)
@@ -434,6 +435,17 @@ func NewAPIHandlerWithAuth(adminAuth AdminAuthConfig, actions ActionSet) http.Ha
 	mux.Handle("GET /api/routing/routes/health", requireAdminAccess(adminAuth, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		handleListRouteHealth(w, r, actions.ListRouteHealth)
 	})))
+	// User key self-service (vNext.2 skeleton — public access with Bearer token)
+	if actions.UserKeyHandler != nil {
+		ukh := actions.UserKeyHandler
+		mux.HandleFunc("POST /api/keys", func(w http.ResponseWriter, r *http.Request) { handleCreateUserKey(w, r, ukh) })
+		mux.HandleFunc("GET /api/keys", func(w http.ResponseWriter, r *http.Request) { handleListUserKeys(w, r, ukh) })
+		mux.HandleFunc("GET /api/keys/{key_id}", func(w http.ResponseWriter, r *http.Request) { handleGetUserKey(w, r, ukh) })
+		mux.HandleFunc("POST /api/keys/{key_id}/pause", func(w http.ResponseWriter, r *http.Request) { handlePauseUserKey(w, r, ukh) })
+		mux.HandleFunc("POST /api/keys/{key_id}/resume", func(w http.ResponseWriter, r *http.Request) { handleResumeUserKey(w, r, ukh) })
+		mux.HandleFunc("DELETE /api/keys/{key_id}", func(w http.ResponseWriter, r *http.Request) { handleDeleteUserKey(w, r, ukh) })
+	}
+
 	mux.Handle("POST /api/routing/resolve", requireAdminAccess(adminAuth, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		handleResolveRoute(w, r, actions.ResolveRoute)
 	})))
@@ -1350,6 +1362,7 @@ func NewActionSetWithStickyRuntime(sqliteDSN string, stickyRuntime stickyStoreRu
 		GetRouteCooldown:                    buildGetRouteCooldownAction(stickyRuntime),
 		ListProviderAccounts:                buildListProviderAccountsAction(sqliteDSN),
 		GetProviderAccountBindingCandidates: buildGetProviderAccountBindingCandidatesAction(sqliteDSN),
+		UserKeyHandler:                      buildUserKeyHandler(sqliteDSN),
 		UpdateProviderAccountBinding:        buildUpdateProviderAccountBindingAction(sqliteDSN),
 		EnableProviderAccount:               buildUpdateProviderAccountStatusAction(sqliteDSN, sqlite.ProviderAccountStatusActive),
 		DisableProviderAccount:              buildUpdateProviderAccountStatusAction(sqliteDSN, sqlite.ProviderAccountStatusDisabled),