feat(portal): M10.1 — fill the 10 customer-area shells

Four real surfaces wired to tenant-registry (settings, settings/api-keys CRUD, audit pagination, products live entitlements), five forward-looking empty states with CTAs. 56 vitest tests + 10 Playwright canaries. lib/format.ts consolidates date helpers.

Refs: M10.1

src/lib/tenant-registry.ts

@@ -30,6 +30,41 @@ export type Entitlement = {
   expires_at?: string | null;
 };
 
+export type APIKey = {
+  id: string;
+  tenant_id: string;
+  product?: string;
+  name: string;
+  scopes: string[];
+  prefix: string;
+  created_by?: string;
+  last_used_at?: string | null;
+  revoked_at?: string | null;
+  created_at: string;
+};
+
+export type AuditEvent = {
+  id: number;
+  tenant_id?: string;
+  actor_id?: string;
+  actor_name?: string;
+  actor_type?: string;
+  action: string;
+  target_id?: string;
+  target_type?: string;
+  target_name?: string;
+  product?: string;
+  metadata?: Record<string, unknown>;
+  source_ip?: string;
+  user_agent?: string;
+  created_at: string;
+};
+
+export type AuditPage = {
+  items: AuditEvent[];
+  next_cursor?: number;
+};
+
 function baseUrl(): string {
   return process.env.TENANT_REGISTRY_URL ?? "http://localhost:8090";
 }
@@ -157,3 +192,79 @@ export async function createTenant(
   if (status === 400) return { ok: false, error: "invalid_input" };
   return { ok: false, error: `unexpected_${status}` };
 }
+
+// ─── api keys ────────────────────────────────────────────────────────────
+
+export async function fetchAPIKeys(tenantId: string): Promise<APIKey[]> {
+  const { status, data } = await req<{ items: APIKey[] }>(
+    "GET",
+    `/v1/api-keys?tenant_id=${encodeURIComponent(tenantId)}`,
+  );
+  if (status === 404) return [];
+  if (status !== 200 || !data) {
+    throw new Error(`tenant-registry: GET api-keys ${status}`);
+  }
+  return data.items;
+}
+
+export type CreateAPIKeyInput = {
+  tenant_id: string;
+  name: string;
+  product?: string;
+  scopes?: string[];
+  created_by?: string;
+};
+
+export type CreateAPIKeyResult =
+  | { ok: true; api_key: APIKey; plaintext: string }
+  | { ok: false; error: string };
+
+export async function createAPIKey(in_: CreateAPIKeyInput): Promise<CreateAPIKeyResult> {
+  const { status, data } = await req<{ api_key: APIKey; plaintext: string }>(
+    "POST",
+    "/v1/api-keys",
+    in_,
+  );
+  if (status === 201 && data) return { ok: true, api_key: data.api_key, plaintext: data.plaintext };
+  if (status === 404) return { ok: false, error: "tenant_not_found" };
+  if (status === 400) return { ok: false, error: "invalid_input" };
+  if (status === 409) return { ok: false, error: "name_taken" };
+  return { ok: false, error: `unexpected_${status}` };
+}
+
+export async function revokeAPIKey(id: string): Promise<{ ok: boolean; error?: string }> {
+  const { status } = await req<unknown>("DELETE", `/v1/api-keys/${encodeURIComponent(id)}`);
+  if (status === 204) return { ok: true };
+  if (status === 404) return { ok: false, error: "not_found" };
+  return { ok: false, error: `unexpected_${status}` };
+}
+
+// ─── audit ───────────────────────────────────────────────────────────────
+
+export type AuditFilter = {
+  tenant_id?: string;
+  product?: string;
+  actor_id?: string;
+  action?: string;
+  since?: string;
+  until?: string;
+  limit?: number;
+  cursor?: number;
+};
+
+export async function fetchAudit(f: AuditFilter): Promise<AuditPage> {
+  const qs = new URLSearchParams();
+  if (f.tenant_id) qs.set("tenant_id", f.tenant_id);
+  if (f.product) qs.set("product", f.product);
+  if (f.actor_id) qs.set("actor_id", f.actor_id);
+  if (f.action) qs.set("action", f.action);
+  if (f.since) qs.set("since", f.since);
+  if (f.until) qs.set("until", f.until);
+  if (f.limit) qs.set("limit", String(f.limit));
+  if (f.cursor) qs.set("cursor", String(f.cursor));
+  const { status, data } = await req<AuditPage>("GET", `/v1/audit?${qs.toString()}`);
+  if (status !== 200 || !data) {
+    throw new Error(`tenant-registry: GET audit ${status}`);
+  }
+  return data;
+}