feat: complete commercial developer workflowspublish-commercial-control-plane

Add tenant-safe usage observability, prepaid billing controls, API key lifecycle management, Embeddings metering, configurable billing alerts, and resilient provider health propagation. Harden Stripe failure handling, migrations, readiness, and the authenticated control-plane UI with end-to-end verification evidence.

1 files changed, 4 insertions, 1 deletions

diff --git a/internal/auth/static_test.go b/internal/auth/static_test.go
index a037ce1..28ca39f 100644
--- a/internal/auth/static_test.go
+++ b/internal/auth/static_test.go
@@ -78,7 +78,7 @@ func TestStaticAuthenticatorAcceptsAnthropicHeader(t *testing.T) {
 
 func TestStaticAuthenticatorLoadsRestrictionsAndRejectsExpiredKey(t *testing.T) {
 	future := time.Now().Add(time.Hour).UTC().Format(time.RFC3339Nano)
-	authenticator, err := NewStatic(`[{"key":"sk-limited","key_id":"key-1","tenant_id":"tenant-1","project_id":"project-1","allowed_models":["model/allowed"],"monthly_spend_micros":1250000,"expires_at":"`+future+`"}]`, false)
+	authenticator, err := NewStatic(`[{"key":"sk-limited","key_id":"key-1","tenant_id":"tenant-1","project_id":"project-1","allowed_models":["model/allowed"],"monthly_spend_micros":1250000,"daily_spend_micros":250000,"requests_per_minute":12,"tokens_per_minute":3400,"expires_at":"`+future+`"}]`, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -91,6 +91,9 @@ func TestStaticAuthenticatorLoadsRestrictionsAndRejectsExpiredKey(t *testing.T)
 	if principal.MonthlySpendMicros != 1_250_000 {
 		t.Fatalf("monthly spend limit = %d", principal.MonthlySpendMicros)
 	}
+	if principal.DailySpendMicros != 250_000 || principal.RequestsPerMinute != 12 || principal.TokensPerMinute != 3400 {
+		t.Fatalf("key spend or rate controls were not loaded: %+v", principal)
+	}
 	if _, ok := principal.AllowedModels["model/allowed"]; !ok {
 		t.Fatalf("allowed model was not loaded: %+v", principal.AllowedModels)
 	}