feat: Kunden-Seite zeigt API-Keys beim Aufklappen

- Klick auf Kundenzeile klappt Key-Panel auf
- Zeigt Agent + Read-only Keys mit Permission-Badge
- Key teilweise maskiert, Kopier-Button vorhanden
- Backend: GET /api/v1/customers/{id}/apikeys
- DB: ListCustomerAPIKeys() nach customer_id gefiltert

backend/db/postgres.go

@@ -1259,6 +1259,38 @@ func (d *Database) UpdateAPIKeyLastUsed(key string) {
 	d.db.Exec("UPDATE api_keys SET last_used = NOW() WHERE key = $1", key)
 }
 
+func (d *Database) ListCustomerAPIKeys(customerID int) ([]APIKey, error) {
+	rows, err := d.db.Query(
+		"SELECT id, name, key, permissions, customer_id, created_at, last_used FROM api_keys WHERE customer_id = $1 ORDER BY permissions, created_at",
+		customerID,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var keys []APIKey
+	for rows.Next() {
+		var k APIKey
+		var lastUsed sql.NullTime
+		var custID sql.NullInt64
+		if err := rows.Scan(&k.ID, &k.Name, &k.Key, &k.Permissions, &custID, &k.CreatedAt, &lastUsed); err != nil {
+			return nil, err
+		}
+		if lastUsed.Valid {
+			k.LastUsed = &lastUsed.Time
+		}
+		if custID.Valid {
+			id := int(custID.Int64)
+			k.CustomerID = &id
+		}
+		keys = append(keys, k)
+	}
+	if keys == nil {
+		keys = []APIKey{}
+	}
+	return keys, rows.Err()
+}
+
 // MigrateConfigAPIKeys migriert API-Keys aus der Config in die DB (einmalig)
 // --- Audit Log ---