CREATE TABLE IF NOT EXISTS user_keys (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    key_id TEXT UNIQUE NOT NULL,
    owner_subject_id TEXT NOT NULL,
    key_fingerprint TEXT NOT NULL,
    masked_preview TEXT NOT NULL,
    display_name TEXT NOT NULL DEFAULT '',
    logical_group_id TEXT NOT NULL DEFAULT '',
    allowed_models TEXT NOT NULL DEFAULT '[]',
    admin_status TEXT NOT NULL DEFAULT 'active' CHECK (admin_status IN ('active','paused','disabled','retired')),
    quota_status TEXT NOT NULL DEFAULT 'ok' CHECK (quota_status IN ('ok','exhausted','limited','unknown')),
    last_used_at TEXT,
    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ','now')),
    expires_at TEXT,
    updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ','now'))
);

CREATE INDEX IF NOT EXISTS idx_user_keys_owner ON user_keys(owner_subject_id);
CREATE INDEX IF NOT EXISTS idx_user_keys_status ON user_keys(admin_status);