feat(platform): per-user API gateway over the OmniRoute API plane

[getwinharris]

Closes part of #103. Adds the per-user API layer over the bapXai/api (OmniRoute) plane.

Read this first — branch lineage

This branch is based on 141b4476, not main. 141b4476 is what is live on the VPS right now, and it is not an ancestor of main — they diverged at f7b33ca6:

f7b33ca6 (merge-base)
├── 141b4476  feat: ship tenant-scoped hosted orchestration   ← LIVE, absent from main
└── 269d9c2f  feat: enforce runtime workspace scope
    8cd0fa05  fix(www): label the Agents browser surface      ← main, never deployed

An earlier attempt based on main would have silently reverted 141b4476 and dropped 5 live pages:

• docs/ecosystem/providers/{anthropic,google,openai,openrouter} — the whole Model providers category
• docs/guide/delegated-tasks

Cause: modelProviders and the "Model providers" group were removed from ecosystem-catalog.ts and customer-ecosystem.ts on the main lineage. That is the UI customers use to connect the BYOK credentials this gateway depends on — shipping it would have added per-user API keys while deleting the way to attach a provider to them.

Basing on the live release makes this deploy purely additive. Someone needs to decide separately whether main or 141b4476 is the intended lineage — this PR does not resolve that, it just avoids regressing production in the meantime.

What this adds

• apps/www/src/server/api-gateway.mjs — API key store and streaming proxy
• apps/www/server.mjs — api.bapx.in host handling, session-gated key management
• Platform page — shared bapX header/nav matching the other subdomains, live API keys UI
• docs/platform/api.md — supported contract and the BYOK boundary, wired into docs nav
• blueprints/tooling--hostinger.md — Hostinger MCP connector (feat(connectors): add Hostinger MCP connector #105)
• internal-docs/ — API integration assessment, agent-stack and agent-team research

Security properties

• Keys are bapx_sk_…; only the SHA-256 hash is stored, so a leaked collection file cannot be replayed.
• Verify uses timingSafeEqual.
• Only /v1/* is exposed. The plane is single-tenant — exposing its dashboard or admin auth would hand one customer the whole appliance.
• The customer's Authorization header is never forwarded upstream; the plane is reached with its own credential.
• Key issuance requires a session. No anonymous issuance.

Validation

End-to-end against the running plane:

Check	Result
Create key (session)	201, secret returned once
Key → GET /v1/models	200, 115 models
POST /v1/chat/completions	200, SSE streams
lastUsedAt	recorded
Revoke → reuse key	401, access cut immediately
Invalid / absent key	401
GET /dashboard with valid key	404
Key admin without session	401
Cross-account key listing	isolated
Secrets in logs	none

Build parity vs the live release: 145 pages → 146, nothing lost, one added. Admin bundle rebuilt (25 MB, 701 assets, all entry refs resolve).

Deploy (not applied — needs permission on the compose file)

/docker/traefik-vmm1/docker-compose.yml:

1. 141b4476 → 98f04e31 (4 bind-mount occurrences)
2. Add under bapx-www environment: - BAPX_API_PLANE_ORIGIN=http://172.17.0.1:20130
3. Append to traefik.http.routers.bapx-www.rule: || Host(`api.bapx.in`)

Then docker compose up -d. Rollback is pointing the mounts back to 141b4476.

Snapshot is already built at releases/agents/98f04e31/. DNS for api.bapx.in already resolves to the host. The API plane runs as a separate compose project at /docker/bapx-api/ — internal only, bound to loopback and the docker bridge, verified not reachable on the public IP.

Never build the plane image on the VPS. It OOM-killed the host on 2026-08-13 (global_oom, 4.68 GB RSS and climbing). Pull prebuilt images only. See internal-docs/platform-api-integration.md.

Summary by Sourcery

Add the customer-facing Platform control plane and secure per-business gateway over the internal OmniRoute API plane.

New Features:

• Add a per-business OpenAI-compatible API gateway with session-managed API key issuance, revocation, model access, and streamed chat proxying.
• Add encrypted business connector management with provider credential masking and workspace-scoped access.
• Add email/password account registration and login alongside GitHub authentication.
• Add Platform UI and documentation for API access, connectors, BYOK model capacity, and integration blueprints.

Bug Fixes:

• Prevent stale orchestration locks from permanently blocking task updates by reclaiming abandoned locks safely.
• Reject invalid approval decisions instead of treating them as cancellations.
• Harden authentication, origin validation, request handling, credential storage, and account persistence against cross-origin actions, malformed data, storage failures, and credential leakage.
• Preserve password credentials during GitHub account creation and prevent unsafe automatic identity linking by email.

Enhancements:

• Document the internal API-plane deployment model, strict BYOK boundary, connector ladder, and current delivery objectives.
• Refresh the Platform experience with shared bapX navigation, live API-key and connector status, and secure OpenAI device authorization.
• Expand agent, hosting, and observability research and add Hostinger, bapX API, and OpenTelemetry blueprints.

Build:

• Record the API-plane deployment constraint to use prebuilt images rather than building on the VPS.

Deployment:

• Prepare the API-plane release for internal deployment behind api.bapx.in while keeping the single-tenant plane inaccessible directly.

Documentation:

• Add customer-facing Platform API, connector, and free-tier documentation and wire it into docs navigation.
• Add internal API integration, agent-stack, agent-team, and cloud-platform research.

Tests:

• Add coverage for API-related authentication boundaries, password identity flows, connector security, origin checks, and orchestration lock recovery.

Chores:

• Update project objectives, TODO tracking, changelog, and third-party API-plane attribution.