feat: add workspace-scoped read-only API and MCP

[nikolajIvanov]

Summary

Add a self-contained, read-only integration layer on top of upstream main:

• Workspace-scoped service keys, managed by owners/admins, with one scope: campaigns:read.
• Key creation UI with 30/60/90-day choices (30 default), hashed storage, one-time token display, expiry and revocation.
• Streamable HTTP MCP at /api/mcp: list_campaigns, get_campaign, get_campaign_stats.
• Equivalent GET-only REST endpoints at /api/v1/campaigns.
• Complete safe campaign details including opening-DM/follow-up/public-reply settings and ordered destination links. Missing links stay null/empty; list responses remain compact.
• English/Traditional Chinese UI, navigation, setup documentation, and reproducible tests.

This is a focused read-only subset, not a port of the entire fork. No campaign creation/activation, messaging tools, library/lifecycle changes, events feed or conversion writes.

Security and operational behavior

Workspace filtering, scope checks, explicit output allowlists, no provider tokens/report secrets/recipient logs. Redis rate limiter (120 requests/key/minute) fails closed with 503. Same-origin checks, streamed JSON body limit of 64 KiB, and no-store responses. API/MCP use Bearer headers; no OAuth server or dynamic client registration. A client supporting custom headers is required.

Keys belong to the workspace and are not auto-revoked when their creator leaves; admins should review them during offboarding. Lists are capped at 100 without pagination.

Migration

One additive migration creates ServiceKey and its workspace FK/indexes. It does not alter existing campaign state. Run migrations and regenerate Prisma before deploying. Redis is required for integration requests.

SMTP/Resend authentication, Docker, worker code, package.json and lockfile are unchanged.

Verification

• npm test with disposable TEST_DATABASE_URL: 354 tests / 30 files passed, including all PostgreSQL suites.
• npm run lint: passed.
• git diff --check: passed.
• All 23 migrations applied successfully to disposable PostgreSQL.
• Actual local HTTP MCP/REST verification with real PostgreSQL/Redis passed: negotiation, scoped details, REST/MCP parity, 401/403/404/405/413 boundaries, revocation and expiry. Script fixtures removed; no Meta messages sent.
• Independent reviewer ran 30 focused tests plus the actual HTTP script; no P0/P1 findings.
• Interactive browser acceptance of the new key-management form has not been performed.

Existing upstream blocker: npm run typecheck and npm run build fail at lib/queue/dm-worker.ts:855 (string | null passed to string). That file is byte-identical to base 257e38d; this PR does not introduce or modify the error. Production compilation succeeds, then the existing TypeScript error stops the build. See #83 for the separate fix. This PR is for review, not a claim of green build/deployment readiness.

[vercel]

@nikolajIvanov is attempting to deploy a commit to the diwenne's projects Team on Vercel.

A member of the Team first needs to authorize it.